Metadata-Version: 2.4
Name: s1eepeng-pypi-oidc-replay-lab
Version: 0.0.1041
Summary: A small calculator used to test PyPI Trusted Publishing and OIDC replay behavior.
Author: S1eepeng
License-Expression: MIT
Project-URL: Source, https://github.com/S1eepeng/pypi-oidc-replay-lab
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: OS Independent
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# PyPI OIDC replay lab

A deliberately small calculator package used to study PyPI Trusted Publishing.

The private GitHub Actions workflow records these black-box experiments:

1. request a GitHub OIDC JWT with `aud=pypi`;
2. submit the same JWT twice to PyPI's mint endpoint;
3. if PyPI rejects the replay, request a second GitHub JWT to obtain token 2;
4. publish three incrementing versions with `token1 -> token2 -> token1`;
5. retain the complete HTTP requests and responses for one day.

Do not copy live JWTs or short-lived PyPI tokens into issues or commits.
