Post #2176664
2026-04-16 08:43 UTC
@thomasfricke@23.social oh my. this is conway's law at it's best.
I do not want to solve google's problem. I do not trust github. I want to allow our users to verify that we built a package. So this is not for me, at least not at this point.
But thank you for the pointer anyways, I do appreciate your reply, this is no criticism of you.
Replies (1)
-
@slink@fosstodon.org 2026-04-16 09:08
Saving this for future self: This is basically entirely a google thing. https://github.com/slsa-framework/slsa/graphs/contributors MarkLodato google TomHennen google lehors IBM joshuagl verizon https://github.com/slsa-framework/slsa-github-generator/graphs/contributors ianlewis google laurentsimon works on gemini, so likely google asraa google