4 ms·

sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that. https://

by arccy 2y ago

sounds convoluted. If you just want a public transparency log, the public rekor instance under the sigstore project is much more appropriate for that. https://www.sigstore.dev/ https://www.sigstore.dev/ https://docs.sigstore.dev/logging/overview/ https://docs.sigstore.dev/logging/overview/

lpapez 2y ago
Sure, but the gosum database is a critical piece of worldwide software infrastructure, so you can count on it being accesible behind many firewalls and always up. And it's completely free and anonymus. Perfect for the purpose.
ithkuil 2y ago
Yeah when I did that there was no public rekor instance ran by the sigstore project so I choose the only available public transparency log I could bend to my needs (x509 transparency logs were an alternative but it'd quickly hit rate limits by acme providers)
skybrian 2y ago
Interesting! Looks like it's being used by some npm packages [1] and soon homebrew will be using it [2]. Any other interesting usage? As a user, the npm usage doesn't seem very prominent. On an npm's web page, there's a checkmark next to the version number on the right side that I hadn't paid any attention to before, with more information at the very bottom of the page. Here's an example. [3] [1] https://blog.sigstore.dev/npm-provenance-ga/ https://blog.sigstore.dev/npm-provenance-ga/ [2] https://blog.sigstore.dev/homebrew-build-provenance/ https://blog.sigstore.dev/homebrew-build-provenance/ [3] https://www.npmjs.com/package/fast-check https://www.npmjs.com/package/fast-check
- mynameisvlad 2y ago
  It’s at the bottom of the page on mobile. On desktop, that’s the first thing on the right hand side of the screen IIRC.
  - skybrian 2y ago
    For me on desktop, the version seems to be the fourth thing down in the right column, under weekly downloads, and there's a checkmark. (Or maybe I'm missing something.)

by arccy 2y ago

lpapez 2y ago

Sure, but the gosum database is a critical piece of worldwide software infrastructure, so you can count on it being accesible behind many firewalls and always up. And it's completely free and anonymus. Perfect for the purpose.

ithkuil 2y ago

Yeah when I did that there was no public rekor instance ran by the sigstore project so I choose the only available public transparency log I could bend to my needs (x509 transparency logs were an alternative but it'd quickly hit rate limits by acme providers)

skybrian 2y ago

Interesting! Looks like it's being used by some npm packages [1] and soon homebrew will be using it [2]. Any other interesting usage? As a user, the npm usage doesn't seem very prominent. On an npm's web page, there's a checkmark next to the version number on the right side that I hadn't paid any attention to before, with more information at the very bottom of the page. Here's an example. [3] [1] https://blog.sigstore.dev/npm-provenance-ga/ https://blog.sigstore.dev/npm-provenance-ga/ [2] https://blog.sigstore.dev/homebrew-build-provenance/ https://blog.sigstore.dev/homebrew-build-provenance/ [3] https://www.npmjs.com/package/fast-check https://www.npmjs.com/package/fast-check

mynameisvlad 2y ago
It’s at the bottom of the page on mobile. On desktop, that’s the first thing on the right hand side of the screen IIRC.
- skybrian 2y ago
  For me on desktop, the version seems to be the fourth thing down in the right column, under weekly downloads, and there's a checkmark. (Or maybe I'm missing something.)