RE: https://mastodon.social/@asfaload/117506063307193577 Here's a small improvement that required some significant refactoring. It's similar to a TOCTTOU: the signature of a release was provided in a second step, leaving a small opportunity window open for an attacker. This is now closed, and additionally, the refactor should make it easier to add support for other forges like @gitlab or @forgejo #security #softwaresupplychain #SoftwareSupplyChainSecurity #foss