News for hackers. Stuff that matters.

A comment on We Executed a Critical Supply Chain Attack on PyTorch. Parent comment

Re:We Executed a Critical Supply Chain Attack on PyTorch by akx on Sunday January 14, 2024 @03:48PM (#38994312)
For the second point, PyPI's trusted publisher implementation does this very well: https://docs.pypi.org/trusted-publishers/
[ Parent | on HN ]
Re:We Executed a Critical Supply Chain Attack on PyTorch by LtWorf on Monday January 15, 2024 @12:54AM (#38997805)
Isn't that what's causing the problem?

Without that there would be no need to have an action to do an upload. It could be comfortably and safely done offline.

[ Parent | on HN ]