diff --git a/docs/user/assets/trusted-publishing/activestate/pending-publisher-form-filled.png b/docs/user/assets/trusted-publishing/activestate/pending-publisher-form-filled.png new file mode 100644 index 000000000000..1b90b77c8a27 Binary files /dev/null and b/docs/user/assets/trusted-publishing/activestate/pending-publisher-form-filled.png differ diff --git a/docs/user/assets/trusted-publishing/activestate/pending-publisher-registered.png b/docs/user/assets/trusted-publishing/activestate/pending-publisher-registered.png new file mode 100644 index 000000000000..32518ae2a60e Binary files /dev/null and b/docs/user/assets/trusted-publishing/activestate/pending-publisher-registered.png differ diff --git a/docs/user/assets/trusted-publishing/activestate/project-publisher-registered.png b/docs/user/assets/trusted-publishing/activestate/project-publisher-registered.png new file mode 100644 index 000000000000..04c80eda591a Binary files /dev/null and b/docs/user/assets/trusted-publishing/activestate/project-publisher-registered.png differ diff --git a/docs/user/assets/trusted-publishing/activestate/project-publishing-form.png b/docs/user/assets/trusted-publishing/activestate/project-publishing-form.png new file mode 100644 index 000000000000..88c1665ae31f Binary files /dev/null and b/docs/user/assets/trusted-publishing/activestate/project-publishing-form.png differ diff --git a/docs/user/trusted-publishers/adding-a-publisher.md b/docs/user/trusted-publishers/adding-a-publisher.md index f9aa1f586bc0..709c5e296ecc 100644 --- a/docs/user/trusted-publishers/adding-a-publisher.md +++ b/docs/user/trusted-publishers/adding-a-publisher.md @@ -97,7 +97,12 @@ each. === "ActiveState" - TODO + For ActiveState, you need to provide the name of the ActiveState project, + the ActiveState organization that project belongs to, and the ActiveState user performing + the publish action. Learn more about getting set up on the ActiveState Platform [here](https://docs.activestate.com/platform/start/PYPI). + ![](/assets/trusted-publishing/activestate/project-publishing-form.png) + Once you click "Add", your publisher will be registered and will appear at the top of the page: + ![](/assets/trusted-publishing/activestate/project-publisher-registered.png) === "GitLab CI/CD" diff --git a/docs/user/trusted-publishers/creating-a-project-through-oidc.md b/docs/user/trusted-publishers/creating-a-project-through-oidc.md index 08ab599435d7..2be461df5f90 100644 --- a/docs/user/trusted-publishers/creating-a-project-through-oidc.md +++ b/docs/user/trusted-publishers/creating-a-project-through-oidc.md @@ -62,7 +62,16 @@ provide the name of the PyPI project that will be created. === "ActiveState" - TODO + Setting up ActiveState to create a PyPI project is the same as + updating a project. You need to provide the name of the ActiveState project, + the ActiveState organization that project belongs to, and the ActiveState user who will be performing + the publish action. Learn more about getting set up on the ActiveState Platform [here](https://docs.activestate.com/platform/start/PYPI). + + ![](/assets/trusted-publishing/activestate/pending-publisher-form-filled.png) + + Clicking "Add" will register the "pending" publisher, and show it to you: + + ![](/assets/trusted-publishing/activestate/pending-publisher-registered.png) === "GitLab CI/CD" diff --git a/docs/user/trusted-publishers/security-model.md b/docs/user/trusted-publishers/security-model.md index ce8bf20f6c59..b26de09d77af 100644 --- a/docs/user/trusted-publishers/security-model.md +++ b/docs/user/trusted-publishers/security-model.md @@ -153,7 +153,23 @@ own security model and considerations. === "ActiveState" - TODO + ### Security Model + + Trusted Publishing occurs from within an isolated build container in the ActiveState + Platform build infrastructure. When a build is triggered by a user that will publish + to PyPI, an OIDC token is generated and passed into the necessary build container as + an environment variable along with your release artifact that will be uploaded. The + OIDC token is used by the build container to request a PyPI API token which it then + uses to upload your release. + + ### Considerations + + * The user configured in the Trusted Publisher must be the user that triggers the + build in the ActiveState Platform. This user will need editing privileges in the + ActiveState organization associated with the project. + * The ActiveState Platform project must be private. + For more information about Trusted Publishing using the ActiveState Platform please + see the [PyPI configuration documentation](https://docs.activestate.com/platform/start/PYPI) and the [ActiveState Platform documentation](https://docs.activestate.com/platform). === "GitLab CI/CD" diff --git a/docs/user/trusted-publishers/using-a-publisher.md b/docs/user/trusted-publishers/using-a-publisher.md index e2a2e90c29a1..84db958eb986 100644 --- a/docs/user/trusted-publishers/using-a-publisher.md +++ b/docs/user/trusted-publishers/using-a-publisher.md @@ -270,7 +270,65 @@ below describe the setup process for each supported trusted publisher. === "ActiveState" - TODO + ActiveState's Platform works as a zero-config CI solution for your dependencies to automatically build cross-platform wheels of your PyPI projects. Once you're set up on the Platform and have linked your PyPI project, you're ready to publish. For more information on getting started with ActiveState, go [here](https://docs.activestate.com/platform/start/PYPI). To begin: + Publish your package to ActiveState's catalog. This will allow ActiveState's Platform to build it for you. + + 1. Run the following command using the State Tool CLI: + ``` + state publish --namespace ORGNAME/language/python --name PKG_NAME SDIST_FILENAME --depend "builder/python-module-builder@>=0" --depend "language/python@>=3" --depend "language/python/setuptools@>=43.0.0" --depend "language/python/wheel@>=0" + ``` + Replace the placeholder values in the block above with your ActiveState organization name--this will usually be `USERNAME-org` (ORGNAME), package name (PKG_NAME), and the filename of your sdist (SDIST_FILENAME) and run the command. Take note of the TIMESTAMP in the output. + + *Note: The namespace must start with your organization name and end with `/language/python`.* + + 2. After publishing your package to ActiveState, you'll need to create a build script file (`buildscript.as`) to build it into a wheel and publish it to PyPI. An example script is shown below. Create a new build script file in the same folder as your `activestate.yaml` file and name it `buildscript.as`. Paste the code below, substituting the placeholder values with those from your project: the timestamp of the package you just published (PUBLISHED_TIMESTAMP), the name of the namespace (ie. folder where you published the ingredient, which will look something like `USERNAME-org/language/python`) (NAMESPACE), the name of your package (PKG_NAME) and the version (VERSION) you're publishing. Save the changes to the file. + ```python + at_time = "PUBLISHED_TIMESTAMP" + publish_receipt = pypi_publisher( + audience = "testpypi", + pypi_uri = "test.pypi.org", + src = wheels + ) + runtime = state_tool_artifacts( + build_flags = [ + ], + src = wheels + ) + sources = solve( + at_time = at_time, + platforms = [ + "7c998ec2-7491-4e75-be4d-8885800ef5f2" + ], + requirements = [ + Req(name = "language/python", version = Eq(value = "3.10.13")), + Req(name = "NAMESPACE/PKG_NAME", version = Eq(value = "VERSION")) + ], + solver_version = null + ) + wheels = wheel_artifacts( + src = sources + ) + + main = runtime + ``` + 3. Then, "commit" this build script to the system by running `state commit` in your terminal. Now you're ready to publish to PyPI! + 4. To publish your wheel to PyPI, run: `state eval publish_receipt`. + That's it! + + You have successfully published a Python wheel using the ActiveState Platform. + + !!! note + Buildscript tips: + + You can leave `pypi_uri` and `audience` fields blank to publish directly to the main PyPI repository. + + The strings after `platforms = [` are the UUIDs of the supported platforms you want to build a wheel for. A list of all supported platforms can be found [here](https://docs.activestate.com/platform/updates/supported-platforms). Select all applicable to your project from the list provided. + + !!! note + If you want to test your wheel before publishing it, you follow these steps before running `state eval publish_receipt`: + 1. To build your wheel on its own, run `state eval wheels` + 2. After building your wheel, run `state builds --all` to view all of the builds available. Take note of the `HASH_ID` of your new wheel. + 3. Run `state builds dl ` to download and test the wheel you've built. === "GitLab CI/CD" diff --git a/warehouse/locale/messages.pot b/warehouse/locale/messages.pot index 9de5f48a558e..101fc4be16f7 100644 --- a/warehouse/locale/messages.pot +++ b/warehouse/locale/messages.pot @@ -1358,10 +1358,10 @@ msgstr "" #: warehouse/templates/manage/account/publishing.html:261 #: warehouse/templates/manage/account/publishing.html:276 #: warehouse/templates/manage/account/publishing.html:291 -#: warehouse/templates/manage/account/publishing.html:326 -#: warehouse/templates/manage/account/publishing.html:348 -#: warehouse/templates/manage/account/publishing.html:370 -#: warehouse/templates/manage/account/publishing.html:392 +#: warehouse/templates/manage/account/publishing.html:332 +#: warehouse/templates/manage/account/publishing.html:354 +#: warehouse/templates/manage/account/publishing.html:376 +#: warehouse/templates/manage/account/publishing.html:398 #: warehouse/templates/manage/account/recovery_codes-burn.html:70 #: warehouse/templates/manage/account/token.html:133 #: warehouse/templates/manage/account/token.html:150 @@ -1391,9 +1391,9 @@ msgstr "" #: warehouse/templates/manage/project/publishing.html:187 #: warehouse/templates/manage/project/publishing.html:229 #: warehouse/templates/manage/project/publishing.html:244 -#: warehouse/templates/manage/project/publishing.html:279 -#: warehouse/templates/manage/project/publishing.html:301 -#: warehouse/templates/manage/project/publishing.html:323 +#: warehouse/templates/manage/project/publishing.html:285 +#: warehouse/templates/manage/project/publishing.html:307 +#: warehouse/templates/manage/project/publishing.html:329 #: warehouse/templates/manage/project/roles.html:273 #: warehouse/templates/manage/project/roles.html:289 #: warehouse/templates/manage/project/roles.html:305 @@ -2562,16 +2562,16 @@ msgstr "" #: warehouse/templates/email/trusted-publisher-added/body.html:45 #: warehouse/templates/email/trusted-publisher-removed/body.html:43 -#: warehouse/templates/manage/account/publishing.html:346 -#: warehouse/templates/manage/project/publishing.html:277 +#: warehouse/templates/manage/account/publishing.html:352 +#: warehouse/templates/manage/project/publishing.html:283 #: warehouse/templates/organizations/profile.html:30 msgid "Organization" msgstr "" #: warehouse/templates/email/trusted-publisher-added/body.html:46 #: warehouse/templates/email/trusted-publisher-removed/body.html:44 -#: warehouse/templates/manage/account/publishing.html:368 -#: warehouse/templates/manage/project/publishing.html:299 +#: warehouse/templates/manage/account/publishing.html:374 +#: warehouse/templates/manage/project/publishing.html:305 msgid "ActiveState Project name" msgstr "" @@ -4317,31 +4317,30 @@ msgid "" msgstr "" #: warehouse/templates/manage/account/publishing.html:27 -#: warehouse/templates/manage/project/publishing.html:25 #, python-format msgid "" -"Read more about GitHub Actions's OpenID Connect support here." msgstr "" #: warehouse/templates/manage/account/publishing.html:38 #: warehouse/templates/manage/account/publishing.html:157 #: warehouse/templates/manage/account/publishing.html:259 -#: warehouse/templates/manage/account/publishing.html:324 +#: warehouse/templates/manage/account/publishing.html:330 msgid "PyPI Project Name" msgstr "" #: warehouse/templates/manage/account/publishing.html:43 #: warehouse/templates/manage/account/publishing.html:162 #: warehouse/templates/manage/account/publishing.html:264 -#: warehouse/templates/manage/account/publishing.html:330 +#: warehouse/templates/manage/account/publishing.html:336 msgid "project name" msgstr "" #: warehouse/templates/manage/account/publishing.html:45 #: warehouse/templates/manage/account/publishing.html:164 #: warehouse/templates/manage/account/publishing.html:266 -#: warehouse/templates/manage/account/publishing.html:338 +#: warehouse/templates/manage/account/publishing.html:344 msgid "The project (on PyPI) that will be created when this publisher is used" msgstr "" @@ -4426,11 +4425,11 @@ msgstr "" #: warehouse/templates/manage/account/publishing.html:139 #: warehouse/templates/manage/account/publishing.html:241 #: warehouse/templates/manage/account/publishing.html:312 -#: warehouse/templates/manage/account/publishing.html:409 +#: warehouse/templates/manage/account/publishing.html:415 #: warehouse/templates/manage/project/publishing.html:122 #: warehouse/templates/manage/project/publishing.html:209 #: warehouse/templates/manage/project/publishing.html:265 -#: warehouse/templates/manage/project/publishing.html:340 +#: warehouse/templates/manage/project/publishing.html:346 #: warehouse/templates/manage/project/roles.html:341 #: warehouse/templates/manage/team/roles.html:131 msgid "Add" @@ -4540,86 +4539,94 @@ msgid "" "identity used for publishing. More details here." msgstr "" -#: warehouse/templates/manage/account/publishing.html:352 -#: warehouse/templates/manage/project/publishing.html:283 +#: warehouse/templates/manage/account/publishing.html:319 +#: warehouse/templates/manage/project/publishing.html:272 +#, python-format +msgid "" +"Read more about ActiveState's OpenID Connect support here." +msgstr "" + +#: warehouse/templates/manage/account/publishing.html:358 +#: warehouse/templates/manage/project/publishing.html:289 msgid "my-organization" msgstr "" -#: warehouse/templates/manage/account/publishing.html:360 -#: warehouse/templates/manage/project/publishing.html:291 +#: warehouse/templates/manage/account/publishing.html:366 +#: warehouse/templates/manage/project/publishing.html:297 msgid "The ActiveState organization name that owns the project" msgstr "" -#: warehouse/templates/manage/account/publishing.html:374 -#: warehouse/templates/manage/project/publishing.html:305 +#: warehouse/templates/manage/account/publishing.html:380 +#: warehouse/templates/manage/project/publishing.html:311 msgid "my-project" msgstr "" -#: warehouse/templates/manage/account/publishing.html:382 -#: warehouse/templates/manage/project/publishing.html:313 +#: warehouse/templates/manage/account/publishing.html:388 +#: warehouse/templates/manage/project/publishing.html:319 msgid "The ActiveState project that will build your Python artifact." msgstr "" -#: warehouse/templates/manage/account/publishing.html:390 -#: warehouse/templates/manage/project/publishing.html:321 -msgid "Actor Username" -msgstr "" - #: warehouse/templates/manage/account/publishing.html:396 #: warehouse/templates/manage/project/publishing.html:327 -msgid "my-username" +msgid "Actor Username" msgstr "" #: warehouse/templates/manage/account/publishing.html:402 #: warehouse/templates/manage/project/publishing.html:333 +msgid "my-username" +msgstr "" + +#: warehouse/templates/manage/account/publishing.html:408 +#: warehouse/templates/manage/project/publishing.html:339 msgid "" "The username for the ActiveState account that will trigger the build of " "your Python artifact." msgstr "" -#: warehouse/templates/manage/account/publishing.html:420 +#: warehouse/templates/manage/account/publishing.html:426 msgid "Manage publishers" msgstr "" -#: warehouse/templates/manage/account/publishing.html:430 +#: warehouse/templates/manage/account/publishing.html:436 msgid "Project" msgstr "" -#: warehouse/templates/manage/account/publishing.html:452 +#: warehouse/templates/manage/account/publishing.html:458 msgid "" "No publishers are currently configured. Publishers for existing projects " "can be added in the publishing configuration for each individual project." msgstr "" -#: warehouse/templates/manage/account/publishing.html:464 +#: warehouse/templates/manage/account/publishing.html:470 msgid "Pending project name" msgstr "" -#: warehouse/templates/manage/account/publishing.html:465 -#: warehouse/templates/manage/project/publishing.html:367 +#: warehouse/templates/manage/account/publishing.html:471 +#: warehouse/templates/manage/project/publishing.html:373 msgid "Publisher" msgstr "" -#: warehouse/templates/manage/account/publishing.html:466 -#: warehouse/templates/manage/project/publishing.html:368 +#: warehouse/templates/manage/account/publishing.html:472 +#: warehouse/templates/manage/project/publishing.html:374 msgid "Details" msgstr "" -#: warehouse/templates/manage/account/publishing.html:478 +#: warehouse/templates/manage/account/publishing.html:484 msgid "" "No pending publishers are currently configured. Publishers for projects " "that don't exist yet can be added below." msgstr "" -#: warehouse/templates/manage/account/publishing.html:486 +#: warehouse/templates/manage/account/publishing.html:492 msgid "Add a new pending publisher" msgstr "" -#: warehouse/templates/manage/account/publishing.html:489 +#: warehouse/templates/manage/account/publishing.html:495 msgid "You can use this page to register \"pending\" trusted publishers." msgstr "" -#: warehouse/templates/manage/account/publishing.html:495 +#: warehouse/templates/manage/account/publishing.html:501 #, python-format msgid "" "These publishers behave similarly to trusted publishers registered " @@ -4630,8 +4637,8 @@ msgid "" "trusted publishers here." msgstr "" -#: warehouse/templates/manage/account/publishing.html:535 -#: warehouse/templates/manage/project/publishing.html:416 +#: warehouse/templates/manage/account/publishing.html:541 +#: warehouse/templates/manage/project/publishing.html:422 #, python-format msgid "" "You must first enable two-factor authentication " @@ -5845,6 +5852,13 @@ msgstr "" msgid "Back to projects" msgstr "" +#: warehouse/templates/manage/project/publishing.html:25 +#, python-format +msgid "" +"Read more about GitHub Actions's OpenID Connect support here." +msgstr "" + #: warehouse/templates/manage/project/publishing.html:258 #, python-format msgid "" @@ -5854,20 +5868,20 @@ msgid "" "here." msgstr "" -#: warehouse/templates/manage/project/publishing.html:359 +#: warehouse/templates/manage/project/publishing.html:365 msgid "Manage current publishers" msgstr "" -#: warehouse/templates/manage/project/publishing.html:363 +#: warehouse/templates/manage/project/publishing.html:369 #, python-format msgid "OpenID Connect publishers associated with %(project_name)s" msgstr "" -#: warehouse/templates/manage/project/publishing.html:379 +#: warehouse/templates/manage/project/publishing.html:385 msgid "No publishers are currently configured." msgstr "" -#: warehouse/templates/manage/project/publishing.html:384 +#: warehouse/templates/manage/project/publishing.html:390 msgid "Add a new publisher" msgstr "" diff --git a/warehouse/templates/manage/account/publishing.html b/warehouse/templates/manage/account/publishing.html index 0433d9c5fe64..413660853d36 100644 --- a/warehouse/templates/manage/account/publishing.html +++ b/warehouse/templates/manage/account/publishing.html @@ -25,7 +25,7 @@ {% macro github_form(request, pending_github_publisher_form) %}

{% trans href="https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect" %} - Read more about GitHub Actions's OpenID Connect support here. + Read more about GitHub Actions' OpenID Connect support here. {% endtrans %}

@@ -315,6 +315,12 @@ {% endmacro %} {% macro activestate_form(request, pending_activestate_pubisher_form) %} +

+ {% trans href="https://docs.activestate.com/platform/user/oidc/" %} + Read more about ActiveState's OpenID Connect support here. + {% endtrans %} +

+ {{ form_error_anchor(pending_activestate_pubisher_form) }}
diff --git a/warehouse/templates/manage/project/publishing.html b/warehouse/templates/manage/project/publishing.html index 7028693bdf39..a4d16f18ef48 100644 --- a/warehouse/templates/manage/project/publishing.html +++ b/warehouse/templates/manage/project/publishing.html @@ -268,6 +268,12 @@ {% endmacro %} {% macro activestate_form(request, activestate_pubisher_form) %} +

+ {% trans href="https://docs.activestate.com/platform/user/oidc/" %} + Read more about ActiveState's OpenID Connect support here. + {% endtrans %} +

+ {{ form_error_anchor(activestate_pubisher_form) }}