4 ms·

Github should provide a certificate when binaries are built from source with their tools.

• g-b-r 2y ago
  They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted In any case, there's for sure no GitHub certificate added to the APKs
  • porridgeraisin 2y ago
    NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
    • g-b-r 2y ago
      I saw, nice It seems to not check it automatically, though?
      • porridgeraisin 2y ago
        Yeah, you have to set provenance flag to true. - uses: JS-DevTools/npm-publish@v2 with: token: ${{ secrets.NPM_TOKEN }} access: public provenance: true For example