REL/SEC: enabling trusted publishing for PyPI

[neutrinoceros]

A recent supply chain attack highlighted the inherent risks of using long-lived tokens to publish packages to PyPI, which was the only option for automated deployment until Trusted Publishing was introduced in 2023. OpenAstronomy's publishing workflows were initially designed around the token-based strategy, and recently added support for using trusted publishing instead.

This project has no visible automated publication mechanism enabled, which suggests that releases are done manually from a maintainer's work station. This is inherently less safe than trusted-publishing, as the work station could be subject to targeted attacks, and downstream users have no way to audit the integrity of the published artifacts.

I'm reporting to all projects I find still relying on insecure publishing strategies, and strongly recommend this project switches to trusted publishing. I'm happy to answer any questions maintainers may have about the process, and I note that most of the work requires administration rights both to the repository and the PyPI project.

[matteobachetti]

Hi @neutrinoceros, thanks a lot for the report. Scary! Yes, we are doing things manually.
Triggered by this, I read Astropy's publish.yml, that -- I think -- checks for new tags every day at 4 pm and launches the update on pypi. What would you recommend in order to make the process quicker and do it straight away after releasing a new tag?

[neutrinoceros]

Astropy itself isn't using Trusted Publishing yet (I reported there too, of course).

checks for new tags every day at 4 pm and launches the update on pypi.

I think you read the part about nightly wheels, which are not published to PyPI. Despite the upload url starting with https://pypi ... this is a dedicated index hosted by conda-forge to the scientific python community.
There is also no reason to wait between a tag and a publication: the former can very well trigger the latter.

For reference you might want to look at:

• how sunpy does it, using OpenAstronomy workflows
• alternatively, here's another, possibly simpler example for a pure Python package of mine