Post #1834535
2026-03-24 22:06 UTC
@sethmlarson @brettcannon any recommendations on how to use those attestations in production? I found the format docs, but I'm not sure what to do with the data without supporting tooling (installers or index mirrors that block installing if the data goes missing?)
That said, I'll start reviewing lockfiles more carefully.
Replies (1)
-
@brettcannon@mastodon.social 2026-03-25 22:14
@tmr232 @sethmlarson Tooling obviously makes it way more useful. But for a PR review there's 2 things. One is if you know a project uses trusted publishing then their should be attestation data. Two, if the attestation data suddenly disappears or changes in an odd way, be wary and check if the project changed something intentionally.