Most likely the plan is to make it compulsory for all projects eventually, just like they made 2fa compulsory.
So less secure is considered as MORE secure by pypi :) Which is consistent with the idea that no PGP signature is more secure than signed uploads. Or the idea that a global token in a clear text file is somehow safer than a password that gets typed every time.
The vulnerability was exactly that the secrets of the trusted branch can get leaked :)
> you can still upload to PyPI manually with an API Token
I can, BUT if you want to be a Trusted Publisher™ the only way is to do it via github.
https://docs.pypi.org/trusted-publishers/
Most likely the plan is to make it compulsory for all projects eventually, just like they made 2fa compulsory.
So less secure is considered as MORE secure by pypi :) Which is consistent with the idea that no PGP signature is more secure than signed uploads. Or the idea that a global token in a clear text file is somehow safer than a password that gets typed every time.