twine-upload: add a nudge for password auth #190

woodruffw · 2023-11-06T04:54:31Z

Adds a nudge to accompany the pre-existing trusted publishing nudge.

Closes #187.

sethmlarson

Thanks Will! Looks great, had a few suggestions:

sethmlarson · 2023-11-08T02:37:59Z

twine-upload.sh

+PASSWORD_DEPRECATION_NUDGE="::warning title=Password-based uploads deprecated::\
+Starting in 2024, PyPI will require all users to enable Two-Factor \
+Authentication. This will consequently require all users to switch \
+to either API tokens or Trusted Publishers (preferred) for package \


Since this is GitHub Actions we're warning in, let's put Trusted Publishers only, similar to the "Trusted Publishers" nudge? (Do we have a link to API keys for folks using reusable workflows in the TP docs?)

Also, is this message worthy of an ::error? Does that message type fail a run or only make the message red?

Since this is GitHub Actions we're warning in, let's put Trusted Publishers only, similar to the "Trusted Publishers" nudge? (Do we have a link to API keys for folks using reusable workflows in the TP docs?)

Yeah, this was my only lingering concern -- by nudging TP only, we might confuse some users of reusable workflows who can't switch yet.

The reusable workflow limitation is documented, but not super prominently: https://docs.pypi.org/trusted-publishers/troubleshooting/#reusable-workflows-on-github

So TL;DR no strong opinion from me -- if you'd rather not mention API tokens here that SGTM, but we should probably be prepared for a ~few users being confused 🙂

Also, is this message worthy of an ::error? Does that message type fail a run or only make the message red?

I believe it just makes the message red, so ::error works for me!

Whoops, this completely fell off my stack. Making these suggested changes now!

Signed-off-by: William Woodruff <[email protected]>

webknjaz

Thanks @woodruffw and @sethmlarson!

[![Mend Renovate logo banner](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish) | action | patch | `v1.8.10` -> `v1.8.11` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.8.11`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.11) [Compare Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.10...v1.8.11) #### 💅 Cosmetic output improvements [@woodruffw](https://togithub.com/woodruffw) added a nudge suggesting the users storing passwords in a GitHub Actions repository secrets to switch to using secretless publishing in [https://github.com/pypa/gh-action-pypi-publish/pull/190](https://togithub.com/pypa/gh-action-pypi-publish/pull/190). This also reminds people that PyPI will start mandating two-factor authentication to perform uploads in 2024. #### 📝 What's Documented [@di](https://togithub.com/di) linked the configuration docs for Trusted Publishing in README via [https://github.com/pypa/gh-action-pypi-publish/pull/179](https://togithub.com/pypa/gh-action-pypi-publish/pull/179). #### 🛠️ Internal dependencies - Cryptography was bumped from 41.0.3 to 41.0.6 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/194](https://togithub.com/pypa/gh-action-pypi-publish/pull/194)ll/194 - Pip was bumped from 22.3.1 to 23.3 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/189](https://togithub.com/pypa/gh-action-pypi-publish/pull/189)ll/189 - pre-commit linters got autoupdated @&#[https://github.com/pypa/gh-action-pypi-publish/pull/184](https://togithub.com/pypa/gh-action-pypi-publish/pull/184)ll/184 - Urllib3 was bumped from 2.0.3 to 2.0.7 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/183](https://togithub.com/pypa/gh-action-pypi-publish/pull/183)ll/18[https://github.com/pypa/gh-action-pypi-publish/pull/185](https://togithub.com/pypa/gh-action-pypi-publish/pull/185)ll/185 #### 💪 New Contributors - [@di](https://togithub.com/di) made their first contribution in [https://github.com/pypa/gh-action-pypi-publish/pull/179](https://togithub.com/pypa/gh-action-pypi-publish/pull/179) **:mirror: Full Diff**: pypa/gh-action-pypi-publish@v1.8.10...v1.8.11 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/allenporter/pyrainbird).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

[![Mend Renovate logo banner](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish) | action | patch | `v1.8.10` -> `v1.8.11` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.8.11`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.11) [Compare Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.10...v1.8.11) #### 💅 Cosmetic output improvements [@woodruffw](https://togithub.com/woodruffw) added a nudge suggesting the users storing passwords in a GitHub Actions repository secrets to switch to using secretless publishing in [https://github.com/pypa/gh-action-pypi-publish/pull/190](https://togithub.com/pypa/gh-action-pypi-publish/pull/190). This also reminds people that PyPI will start mandating two-factor authentication to perform uploads in 2024. #### 📝 What's Documented [@di](https://togithub.com/di) linked the configuration docs for Trusted Publishing in README via [https://github.com/pypa/gh-action-pypi-publish/pull/179](https://togithub.com/pypa/gh-action-pypi-publish/pull/179). #### 🛠️ Internal dependencies - Cryptography was bumped from 41.0.3 to 41.0.6 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/194](https://togithub.com/pypa/gh-action-pypi-publish/pull/194)ll/194 - Pip was bumped from 22.3.1 to 23.3 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/189](https://togithub.com/pypa/gh-action-pypi-publish/pull/189)ll/189 - pre-commit linters got autoupdated @&#[https://github.com/pypa/gh-action-pypi-publish/pull/184](https://togithub.com/pypa/gh-action-pypi-publish/pull/184)ll/184 - Urllib3 was bumped from 2.0.3 to 2.0.7 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/183](https://togithub.com/pypa/gh-action-pypi-publish/pull/183)ll/18[https://github.com/pypa/gh-action-pypi-publish/pull/185](https://togithub.com/pypa/gh-action-pypi-publish/pull/185)ll/185 #### 💪 New Contributors - [@di](https://togithub.com/di) made their first contribution in [https://github.com/pypa/gh-action-pypi-publish/pull/179](https://togithub.com/pypa/gh-action-pypi-publish/pull/179) **:mirror: Full Diff**: pypa/gh-action-pypi-publish@v1.8.10...v1.8.11 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/allenporter/flux-local).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [pypa/gh-action-pypi-publish](https://togithub.com/pypa/gh-action-pypi-publish) | action | patch | `v1.8.10` -> `v1.8.11` | --- ### Release Notes <details> <summary>pypa/gh-action-pypi-publish (pypa/gh-action-pypi-publish)</summary> ### [`v1.8.11`](https://togithub.com/pypa/gh-action-pypi-publish/releases/tag/v1.8.11) [Compare Source](https://togithub.com/pypa/gh-action-pypi-publish/compare/v1.8.10...v1.8.11) #### 💅 Cosmetic output improvements [@woodruffw](https://togithub.com/woodruffw) added a nudge suggesting the users storing passwords in a GitHub Actions repository secrets to switch to using secretless publishing in [https://github.com/pypa/gh-action-pypi-publish/pull/190](https://togithub.com/pypa/gh-action-pypi-publish/pull/190). This also reminds people that PyPI will start mandating two-factor authentication to perform uploads in 2024. #### 📝 What's Documented [@di](https://togithub.com/di) linked the configuration docs for Trusted Publishing in README via [https://github.com/pypa/gh-action-pypi-publish/pull/179](https://togithub.com/pypa/gh-action-pypi-publish/pull/179). #### 🛠️ Internal dependencies - Cryptography was bumped from 41.0.3 to 41.0.6 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/194](https://togithub.com/pypa/gh-action-pypi-publish/pull/194)ll/194 - Pip was bumped from 22.3.1 to 23.3 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/189](https://togithub.com/pypa/gh-action-pypi-publish/pull/189)ll/189 - pre-commit linters got autoupdated @&#[https://github.com/pypa/gh-action-pypi-publish/pull/184](https://togithub.com/pypa/gh-action-pypi-publish/pull/184)ll/184 - Urllib3 was bumped from 2.0.3 to 2.0.7 @&#[https://github.com/pypa/gh-action-pypi-publish/pull/183](https://togithub.com/pypa/gh-action-pypi-publish/pull/183)ll/18[https://github.com/pypa/gh-action-pypi-publish/pull/185](https://togithub.com/pypa/gh-action-pypi-publish/pull/185)ll/185 #### 💪 New Contributors - [@di](https://togithub.com/di) made their first contribution in [https://github.com/pypa/gh-action-pypi-publish/pull/179](https://togithub.com/pypa/gh-action-pypi-publish/pull/179) **:mirror: Full Diff**: pypa/gh-action-pypi-publish@v1.8.10...v1.8.11 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/ansible-community/molecule-hetznercloud).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

webknjaz · 2024-04-26T16:40:59Z

twine-upload.sh

@@ -40,6 +40,13 @@ INPUT_VERIFY_METADATA="$(get-normalized-input 'verify-metadata')"
 INPUT_SKIP_EXISTING="$(get-normalized-input 'skip-existing')"
 INPUT_PRINT_HASH="$(get-normalized-input 'print-hash')"

+PASSWORD_DEPRECATION_NUDGE="::error title=Password-based uploads deprecated::\
+Starting in 2024, PyPI will require all users to enable Two-Factor \


@woodruffw FYI looks like it's time to drop that future tense from the error message. So I filed #233 for when somebody gets to it.

Progress! 😄

I'll go ahead and do it now, since it's a tiny change 🙂

twine-upload: add a nudge for password auth

254a0d4

Closes pypa#187.

woodruffw mentioned this pull request Nov 6, 2023

Proposal: warn the user on user/password pair use #187

Closed

sethmlarson reviewed Nov 8, 2023

View reviewed changes

twine-upload: ::error, switch nudge order

2319287

Signed-off-by: William Woodruff <[email protected]>

woodruffw requested a review from sethmlarson November 22, 2023 22:28

sethmlarson approved these changes Nov 22, 2023

View reviewed changes

webknjaz approved these changes Nov 29, 2023

View reviewed changes

webknjaz merged commit 2fa448a into pypa:unstable/v1 Nov 29, 2023
2 checks passed

woodruffw deleted the ww/warn-password-auth branch November 29, 2023 07:16

webknjaz mentioned this pull request Apr 26, 2024

[TODO] Update the 2FA nudge error message to use present tense #233

Closed

webknjaz reviewed Apr 26, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

twine-upload: add a nudge for password auth #190

twine-upload: add a nudge for password auth #190

woodruffw commented Nov 6, 2023

sethmlarson left a comment

sethmlarson Nov 8, 2023

woodruffw Nov 8, 2023

woodruffw Nov 22, 2023

webknjaz left a comment

webknjaz Apr 26, 2024

woodruffw Apr 26, 2024

twine-upload: add a nudge for password auth #190

twine-upload: add a nudge for password auth #190

Conversation

woodruffw commented Nov 6, 2023

sethmlarson left a comment

Choose a reason for hiding this comment

sethmlarson Nov 8, 2023

Choose a reason for hiding this comment

woodruffw Nov 8, 2023

Choose a reason for hiding this comment

woodruffw Nov 22, 2023

Choose a reason for hiding this comment

webknjaz left a comment

Choose a reason for hiding this comment

webknjaz Apr 26, 2024

Choose a reason for hiding this comment

woodruffw Apr 26, 2024

Choose a reason for hiding this comment