3 ms·What's next, checking that Releases match the code on Github?by axus 2y agoWhat's next, checking that Releases match the code on Github?jiggawatts 2y agoWith what, a reproducible build? Madness! Madness I say!blueflow 2y agoHaving a reproducible build does not prove that the tarball contains the same source as git.pkaeding 2y agoSLSA aims to achieve this, though, right? Specifically going from level 2 to level 3.deleted 2y ago[deleted]