alt Hacker NewsYes, that is right - that's the purpose of attesting builds.
Do you see any other alternative?
Replies
breakwaterlabs • yesterday at 8:44 PM
If I understand this correctly the fundamental problem here is what codesigning / pgp solve.
➕ show 1 reply
Yes, that is right - that's the purpose of attesting builds.
Do you see any other alternative?
If I understand this correctly the fundamental problem here is what codesigning / pgp solve.
The current formats (publish and SLSA provenance) are for attesting publishing and build steps, respectively, but there's nothing stopping PyPI from adding a different, new attestation statement for local builds (something that conveys "I did this locally, and I was this principal (email address) when I did it").