4 ms·
They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted In any case,
by g-b-r 2y ago
They added something to verify if the binary came out of their CI only a few months ago; I haven't checked now, but it seemed extremely convoluted
In any case, there's for sure no GitHub certificate added to the APKs
- porridgeraisin 2y agoNPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
- g-b-r 2y agoI saw, nice It seems to not check it automatically, though?
- porridgeraisin 2y agoYeah, you have to set provenance flag to true. - uses: JS-DevTools/npm-publish@v2 with: token: ${{ secrets.NPM_TOKEN }} access: public provenance: true For example