But could you just reiterate, like, what is a trusted publisher and how does that benefit on both sides of the security situation? Sure.

Yeah, so Trusted Publishing is a protocol based on OpenID Connect, which is kind of similar to OAuth, where you can set on PyPI, you can say, this is where you can expect my project to be built from.

And then if you go off to an open ID provider, for example, like GitHub Actions or GitLab CI or Google Cloud Build, like there's a whole bunch of different providers.

If you go off to one of these providers and you say, okay, I want to use Trusted Publishing.

This is my Python project, whatever.

It's going to use Trusted Publishing.

You set up these links, these like essentially like pre-configure what's going to happen.

Okay.

... maybe your thoughts on this full-time thing.

Yeah.

So I, hi everyone, Seth Larson, uh, security developer in residence at the Python Software Foundation.

I work primarily on kind of, like, everything that is not IPI backend, so that's the Python language, the runtime, the, um, security response team for Python and PIP, uh, packaging tools and standards, and then kind of like how security world interacts with Python and vice versa, right? So like CBE and all that.

Um, and recently a core developer, very recently.

Um, so to answer the, the, how, how does, uh, this role and all that interacting with volunteers, my...

The, the way that I've tried to, like, because my space is, like, so large, [laughs] my, my area of, uh, where I'm trying to focus, what I end up doing is I try to find projects that are obviously, like, high impact, all of that, right? Like, you don't wanna be doing thing.

You're like, "Well, now what do I do?"