In PyPI, the ability to publish packages without linking to passwords and API tokens has been implemented.
The Python Package Index (PyPI) repository has introduced a new secure method for publishing packages, which allows for the avoidance of storing fixed passwords and access tokens for APIs in external systems (for example, in GitHub Actions). This new authentication method is called ‘Trusted Publishers’ and aims to address the issue of malicious updates being published due to the compromise of external systems and […]
