Post #2470516

RE: https://cosocial.ca/@mhoye/116558500702524583 > The sigstore string present in the file indicates the implant also submits a Sigstore provenance attestation to a transparency log after publishing. I've been wary of any kind of automated "provenance", because anything that's automated can be hijacked, and cryptographic assurances which reduce to "it was built in our CI runner" are pretty useless