PyPI now supports digital attestations

They even got some public money from Germany's sovreign tech fund to couple uploads with gigantic USA companies.

This is probably deserving a criminal investigation since it appears the funds were probably misused?

Well done guys! Good job!

Thanks for pointing this out! In general, the sovereign tech fund should not fund Python or the PSF, since the administration is U.S. dominated and the whole organization is captured by U.S. corporations.

Unpaid developers from Europe (and Asia) just serve as disposable work horses for the U.S. "elites".

I'm just sad I didn't think to write this earlier and now it won't be seen by many.

You can count me among those that are suspicious that this is a frog-boiling step, but it doesn't appear to me that STF money went to this, from https://www.sovereign.tech/tech/python-package-index#what-ar...

Maybe there is a case to be made for STF to fund making Codeberg (a German-headquartered organization) one of the PyPI trusted hosts. If Codeberg were supported, that would go a long way to addressing fears. And conversely, if Codeberg can't meet PyPI's bar, that suggests complete commercial capture.

Yes I agree. It'd be nice if codeberg got some funding and could be used to upload stuff in the same way github can.

Then pypi wouldn't just me a means to the end of keeping people on github rather than going to open platforms.