twine-upload: add a nudge for trusted publishing

[woodruffw]

cc @sethmlarson and @di as well for language approval 🙂

Closes #164.

[sethmlarson]

The wording and implementation looks good! I wanted to note that we may only want to emit this warning when using an index that supports Trusted Publishers (ie pypi.org and test.pypi.org). Is there interest in having that caveat implemented too?

[woodruffw]

I wanted to note that we may only want to emit this warning when using an index that supports Trusted Publishers (ie pypi.org and test.pypi.org). Is there interest in having that caveat implemented too?

Yeah, that's a good point -- I can work that in.

[woodruffw]

NB: This should match both test.pypi.org and pypi.org.

Technically other indices can also support trusted publishing, and the maximally correct way to handle these would be a network round-trip to the audience endpoint that we defined for this purpose.

That seemed like a relatively heavy check to add for a pretty small case, so I've left it out. But if you all prefer we have it, then I think I should probably rewrite this nudge in Python a la the oidc-exchange.py helper 🙂

[sethmlarson]

I'm happy with this initial approach.

[sethmlarson]

@di @webknjaz I'm not an actual reviewer for this project, are you both okay with this approach to filtering indices?

[webknjaz]

Thanks, I think this if fine for now. We do an audience lookup inside the OIDC flow, so moving it out could be helpful. But let's postpone that for now since it requires rewriting sh script that would be out of the scope here.