Hi all
The threema.gateway package is currently uploaded to PyPI via twine with maintainer credentials. PyPI now supports https://docs.pypi.org/trusted-publishers/ — a mechanism that ties uploads cryptographically to a specific GitHub Actions workflow via OIDC, removing the need for long-lived API tokens or passwords.
This would:
- Eliminate the risk of compromised maintainer credentials leading to malicious uploads
- Provide verifiable attestation that a PyPI release was built from a specific commit in this repo
- Align with supply chain security best practices (SLSA, Sigstore)
Especially relevant since threema.gateway handles cryptographic keys and encrypted messaging — downstream consumers (e.g. Home Assistant) benefit from being able to verify the package origin.
Setup is straightforward: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/
Best, LukasQ
Hi all
The threema.gateway package is currently uploaded to PyPI via twine with maintainer credentials. PyPI now supports https://docs.pypi.org/trusted-publishers/ — a mechanism that ties uploads cryptographically to a specific GitHub Actions workflow via OIDC, removing the need for long-lived API tokens or passwords.
This would:
Especially relevant since threema.gateway handles cryptographic keys and encrypted messaging — downstream consumers (e.g. Home Assistant) benefit from being able to verify the package origin.
Setup is straightforward: https://docs.pypi.org/trusted-publishers/creating-a-project-through-oidc/
Best, LukasQ