Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

twine-upload: add a nudge for trusted publishing #167

Merged
merged 2 commits into from Jul 12, 2023
Merged

twine-upload: add a nudge for trusted publishing #167

merged 2 commits into from Jul 12, 2023

Conversation

woodruffw
Copy link
Member

cc @sethmlarson and @di as well for language approval 🙂

Closes #164.

@woodruffw
twine-upload: add a nudge for trusted publishing
be69596 
Closes pypa#164.

Signed-off-by: William Woodruff <william@trailofbits.com>
sethmlarson
sethmlarson approved these changes Jul 10, 2023
View reviewed changes
Copy link

@sethmlarson sethmlarson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The wording and implementation looks good! I wanted to note that we may only want to emit this warning when using an index that supports Trusted Publishers (ie pypi.org and test.pypi.org). Is there interest in having that caveat implemented too?

@woodruffw
Copy link
Member Author

I wanted to note that we may only want to emit this warning when using an index that supports Trusted Publishers (ie pypi.org and test.pypi.org). Is there interest in having that caveat implemented too?

Yeah, that's a good point -- I can work that in.

@woodruffw
twine-upload: only nudge on PyPI-looking domains
e90e853 
Signed-off-by: William Woodruff <william@trailofbits.com>
woodruffw
woodruffw commented Jul 10, 2023
View reviewed changes
twine-upload.sh
@@ -53,10 +59,18 @@ elif [[ "${INPUT_USER}" == '__token__' ]]; then
echo \
'::notice::Using a user-provided API token for authentication' \
"against ${INPUT_REPOSITORY_URL}"

if [[ "${INPUT_REPOSITORY_URL}" =~ pypi\.org ]]; then
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NB: This should match both test.pypi.org and pypi.org.

Technically other indices can also support trusted publishing, and the maximally correct way to handle these would be a network round-trip to the audience endpoint that we defined for this purpose.

That seemed like a relatively heavy check to add for a pretty small case, so I've left it out. But if you all prefer we have it, then I think I should probably rewrite this nudge in Python a la the oidc-exchange.py helper 🙂

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm happy with this initial approach.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@di @webknjaz I'm not an actual reviewer for this project, are you both okay with this approach to filtering indices?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, I think this if fine for now. We do an audience lookup inside the OIDC flow, so moving it out could be helpful. But let's postpone that for now since it requires rewriting sh script that would be out of the scope here.

@webknjaz webknjaz enabled auto-merge July 12, 2023 00:43
@webknjaz webknjaz merged commit 68276eb into pypa:unstable/v1 Jul 12, 2023
2 checks passed
@woodruffw woodruffw deleted the tob-nudge branch July 12, 2023 00:44
@pquentin pquentin mentioned this pull request Jul 12, 2023
Merged
renovate bot added a commit to allenporter/flux-local that referenced this pull request Jul 13, 2023
@renovate
Update pypa/gh-action-pypi-publish action to v1.8.8 (#275)
7c314d8 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.7` -> `v1.8.8` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.8.8`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.8)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.7...v1.8.8)

##### 💅 Cosmetic output impovements

- In
[pypa/gh-action-pypi-publish#167,
[@&#8203;woodruffw](https://togithub.com/woodruffw) introduced a
nudge-warning encoraging people to start using secretless publishing to
PyPI, as suggested by [@&#8203;sethmlarson] in
[pypa/gh-action-pypi-publish#164,
collaborating with [@&#8203;di](https://togithub.com/di).

*:bulb: Tip:* The OIDC-based trusted publishing integration details can
be found in the action README at
https://github.com/marketplace/actions/pypi-publish#trusted-publishing
and on the PyPI docs page at https://docs.pypi.org/trusted-publishers/.
It's gone GA on April 20, 2023, during PyCon:
https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/.
And the Trail Of Bits blog post has some deeper explanation here:
https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/.

##### 🛠️ Internal dependencies

- [@&#8203;pquentin] bumped the runtime dependency pins to the recent
versions
@&#[pypa/gh-action-pypi-publish#168.

##### 💪 New Contributors

- [@&#8203;pquentin](https://togithub.com/pquentin) made their first
contribution in
[pypa/gh-action-pypi-publish#168

**:mirror: Full Diff**:
pypa/gh-action-pypi-publish@v1.8.7...v1.8.8

[@&#8203;pquentin]: https://togithub.com/sponsors/pquentin

[@&#8203;sethmlarson]: https://togithub.com/sponsors/sethmlarson

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/allenporter/flux-local).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi41LjMiLCJ1cGRhdGVkSW5WZXIiOiIzNi41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
renovate bot added a commit to allenporter/pyrainbird that referenced this pull request Jul 13, 2023
@renovate
Update pypa/gh-action-pypi-publish action to v1.8.8 (#211)
8fbfb21 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.7` -> `v1.8.8` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.8.8`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.8)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.7...v1.8.8)

#### 💅 Cosmetic output impovements

- In
[pypa/gh-action-pypi-publish#167,
[@&#8203;woodruffw](https://togithub.com/woodruffw) introduced a
nudge-warning encoraging people to start using secretless publishing to
PyPI, as suggested by [@&#8203;sethmlarson] in
[pypa/gh-action-pypi-publish#164,
collaborating with [@&#8203;di](https://togithub.com/di).

*:bulb: Tip:* The OIDC-based trusted publishing integration details can
be found in the action README at
https://github.com/marketplace/actions/pypi-publish#trusted-publishing
and on the PyPI docs page at https://docs.pypi.org/trusted-publishers/.
It's gone GA on April 20, 2023, during PyCon:
https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/.
And the Trail Of Bits blog post has some deeper explanation here:
https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/.

#### 🛠️ Internal dependencies

- [@&#8203;pquentin] bumped the runtime dependency pins to the recent
versions
@&#[pypa/gh-action-pypi-publish#168.

#### 💪 New Contributors

- [@&#8203;pquentin](https://togithub.com/pquentin) made their first
contribution in
[pypa/gh-action-pypi-publish#168

**:mirror: Full Diff**:
pypa/gh-action-pypi-publish@v1.8.7...v1.8.8

[@&#8203;pquentin]: https://togithub.com/sponsors/pquentin

[@&#8203;sethmlarson]: https://togithub.com/sponsors/sethmlarson

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/allenporter/pyrainbird).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi41LjMiLCJ1cGRhdGVkSW5WZXIiOiIzNi41LjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIn0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
andrewpollock pushed a commit to google/osv.dev that referenced this pull request Aug 9, 2023
@renovate-bot
Update pypa/gh-action-pypi-publish action to v1.8.8 (#1518)
8e719ba 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish)
| action | patch | `v1.8.7` -> `v1.8.8` |

---

### Release Notes

<details>
<summary>pypa/gh-action-pypi-publish
(pypa/gh-action-pypi-publish)</summary>

###
[`v1.8.8`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.8)

[Compare
Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.7...v1.8.8)

#### 💅 Cosmetic output improvements

- In
[pypa/gh-action-pypi-publish#167,
[@&#8203;woodruffw](https://togithub.com/woodruffw) introduced a
nudge-warning encouraging people to start using secretless publishing to
PyPI, as suggested by [@&#8203;sethmlarson] in
[pypa/gh-action-pypi-publish#164,
collaborating with [@&#8203;di](https://togithub.com/di).

*:bulb: Tip:* The OIDC-based trusted publishing integration details can
be found in the action README at
https://github.com/marketplace/actions/pypi-publish#trusted-publishing
and on the PyPI docs page at https://docs.pypi.org/trusted-publishers/.
It's gone GA on April 20, 2023, during PyCon:
https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/.
And the Trail Of Bits blog post has some deeper explanation here:
https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/.

#### 🛠️ Internal dependencies

- [@&#8203;pquentin] bumped the runtime dependency pins to the recent
versions
@&#[pypa/gh-action-pypi-publish#168.

#### 💪 New Contributors

- [@&#8203;pquentin](https://togithub.com/pquentin) made their first
contribution in
[pypa/gh-action-pypi-publish#168

**:mirror: Full Diff**:
pypa/gh-action-pypi-publish@v1.8.7...v1.8.8

[@&#8203;pquentin]: https://togithub.com/sponsors/pquentin

[@&#8203;sethmlarson]: https://togithub.com/sponsors/sethmlarson

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 6am on wednesday" in timezone
Australia/Sydney, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/google/osv.dev).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi4yNy4xIiwidXBkYXRlZEluVmVyIjoiMzYuNDAuMyIsInRhcmdldEJyYW5jaCI6Im1hc3RlciJ9-->
@webknjaz webknjaz mentioned this pull request Aug 25, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@webknjaz webknjaz webknjaz left review comments

@sethmlarson sethmlarson sethmlarson approved these changes

@di di di approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Nudge users to use Trusted Publishers when publishing to PyPI and TestPyPI
4 participants
@woodruffw @di @webknjaz @sethmlarson