<story><title>Introducing &apos;Trusted Publishers&apos;</title><url>https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/</url></story><parent_chain></parent_chain><comment><author>skissane</author><text>This is a great feature, but its name is going to confuse people.&lt;p&gt;Before I read the article, I thought it was going to be about some kind of additional verification process to check that publishers are not malicious and have adequate security practices, resulting in two tiers of publishers, &amp;quot;trusted&amp;quot; and &amp;quot;untrusted&amp;quot;. You might then configure pip to only install packages from &amp;quot;trusted publishers&amp;quot; by default, and you have to go through some scary confirmation prompts to install packages from untrusted ones.&lt;p&gt;Then I read the article, and I realise it wasn&amp;#x27;t what I was expecting at all. If you&amp;#x27;d called it &amp;quot;OIDC Authenticated Publishers&amp;quot;, I would have known what it was about from the start, and wouldn&amp;#x27;t have walked into the topic with the wrong expectation</text></comment>
<story><title>Introducing &apos;Trusted Publishers&apos;</title><url>https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/</url></story><parent_chain></parent_chain><comment><author>woodruffw</author><text>I’m one of the people who helped design and build this functionality; happy to answer any questions about it!</text></comment>