TLDR Tech / InfoSec
Woodruff: You shouldn't trust trusted publishing
PyPI's trusted publishing only authenticates the machine identity behind an upload, not the package's safety or quality, a distinction PyPI reinforces by deliberately withholding any green checkmark styling.
Read the full story