News for hackers. Stuff that matters.

A comment on Zed Editor automatically downloads binaries and NPM packages without consent. Parent comment

Re:Zed Editor automatically downloads binaries and NPM packa... by wlamartin on Monday July 08, 2024 @08:02AM (#40904600)
Ah, I think you might be pleasantly surprised that this is an area being focused on right now with attestations[1] for example, here are the attestations for the GitHub CLI[2].

1: https://github.blog/2024-05-02-introducing-artifact-attestat...

2: https://github.com/cli/cli/attestations

[ Parent | on HN ]
Re:Zed Editor automatically downloads binaries and NPM packa... by g-b-r on Wednesday July 10, 2024 @12:25PM (#40928589)
Maybe this whole cryptographic stuff has some use, but all that which was needed was for GitHub to declare when a file was uploaded manually and when by a workflow (specifying which workflow).

This looks so complex that it might well be just smoke and mirrors

[ Parent | on HN ]