[woodruffw]

These kinds of comments are borderline mendacious: you can observe, trivially, that 50% of the Trusted Publishers currently known to PyPI are neither Google nor Microsoft controlled[1].

If PyPI accepts two more likely ones, a full 2/3rds will unrelated to GitHub.

[1]: https://docs.pypi.org/trusted-publishers/adding-a-publisher/

[guappa]

Ping me when one of them will be an open source entity rather than a company.

[woodruffw]

https://docs.pypi.org/trusted-publishers/internals/#how-do-i...

[immibis]

Wow. I get to choose one from a total of FOUR large corporations! Amazing openness!

[woodruffw]

Once again: this is constrained by design. If you don’t want to use OpenID Connect, just create a token on PyPI and publish the normal way. You are not, and will never be, required to use this feature.

[cpburns2009]

Wow, you can use a whole two other providers from your list: Gitlab and ActiveState. Color me unimpressed.