Apropos of some recent discussions, I think PyPI ought to publish a security roadmap that explains what is happening into the far future with attestations, what the ideal world is, what work developers are going to be expected to do, and how we deal with alternate threat models that do not necessarily match PyPI's expectations:
0 Boosts
0 Likes
@glyph I'm in full agreement here :)