Woodruff: You shouldn't trust trusted publishing

William Woodruff, better known online as "yossarian", has published a blog post to make the case that users should not place their trust in trusted publishing: Trusted Publishing is a mechanism for establishing trust between an external machine identity (like a CI/CD workflow) and one or more projects on a package index/registry. The "trust" in "Trusted Publishing" refers to that trust relationship, and not to anything else. It is not, and cannot be, a signal for package trust or quality.…

Quelle: Originalartikel öffnen