Adoption of Trusted Publishers Growing Among Open Source Pac...

OpenSSF has released a guide to encourage the adoption of Trusted Publishers among open source package repositories, a method designed to enhance security by using short-lived identity tokens for authentication, thereby reducing the risks associated with long-lived secrets. This method, first introduced by PyPI in April 2023, eliminates the need for username/password combinations or manually generated API tokens by allowing developers to publish to repositories without managing long-lived API keys. Contributors to the OpenSSF Securing Software Repositories Working Group authored this guide, highlighting the technical details of how PyPI verifies OIDC ID tokens. Since its implementation, more than 14,000 projects have adopted Trusted Publishers, with its benefits underscored by the added security of short-lived tokens and the reduction in potential misuse by attackers. The method has also been adopted by other platforms like Dart's pub.dev, and its growing adoption signifies a positive step towards improving supply chain security across ecosystems. William Woodruff of Trail of Bits emphasized Trusted Publishers' role in achieving security goals such as temporary credentials and seamless maintainer transitions, and noted its potential for broader implementation across package indices.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.