Mastodawn

via @dotnet : New Trusted Publishing enhances security on NuGet.org

Announcing Trusted Publishing on NuGet.org - a safer way to publish packages using short-lived tokens instead of long-lived API keys

.NET Blog

Trusted Publishing gives provenance of which repo the files were uploaded from, the workflow file, and commit. For example:

Downstream verification for installers such as pip is the next step:

HTTP library with thread-safe connection pooling, file post, and more.

PyPI