A new public beta of GitHub Releases

Re:A new public beta of GitHub Releases by dane-pgp on Tuesday October 05, 2021 @05:59AM (#28757286)

It would be nice if the release process also added the hash of any built binaries to a distributed append-only log. That's sort of the approach that sigstore and rekor were made for, to enable Binary Transparency, and they're already being used in the Arch Linux package ecosystem:

https://github.com/kpcyrd/pacman-bintrans

[ Parent | on HN ]

Re:A new public beta of GitHub Releases by mylesborins on Tuesday October 05, 2021 @09:55AM (#28759529)

this is definitely on our radar! We didn't do any major work on artifacts / assets as part of this effort but there are a bunch of backlogged items, including individual hashes, that we would like to do in the future.

[ Parent | on HN ]

Re:A new public beta of GitHub Releases by jacques_chester on Tuesday October 05, 2021 @10:37AM (#28760084)

I'm interested in talking about this. Could you email me at my work address (in my profile)?

[ Parent | on HN ]

Re:A new public beta of GitHub Releases by mylesborins on Tuesday October 05, 2021 @11:17AM (#28760598)

Might make the most sense to kick off a thread in https://github.com/github/feedback/discussions/5962 so we can have a broader conversation

[ Parent | on HN ]