PyPI, npm, RubyGems and Crates.io have all adopted OIDC-based trusted publishing from CI, specifically to get long-lived API tokens out of repository secrets in order to reduce the risk of supply chain attacks against their respective industries. This currently looks to be unsupported by the Gradle Plugin Portal Is there any work going on towards trying to make similar improvements in the Gradle Plugin Portal? AFAIK The Gradle Plugin Portal has never had a formal penetration test (beyond the auditing I did when I was an employee back 2019-2022). The portal is critical to the supply chain for the entire Android and Java ecosystem. Given the significant uptick in supply chain attacks we've seen against the NPM any Python ecosystems by actors like TeamPCP and North Korea, what is the Gradle team doing to harden the supply chain infrastructure we all rely upon against exploitation?

> Is there any work going on towards trying to make similar improvements in the Gradle Plugin Portal? As communicated here, we are recently rolled out a better authentication system to the Plugin Portal. OIDC-based flows are definitely interesting but not something we have planned just yet. And when looking at some of the recent attacks, it is not a silver bullet for protecting unwanted publications. If the repository is compromised, the end result is the same. > what is the Gradle team doing to harden the supply chain infrastructure we all rely upon against exploitation? The authentication solution migration was the first step. Stay tuned for more.