3 ms·

Hopefully the attestation is bound to a specific commit, so you can know the binaries came from the source? Otherwise I don't get it.

• guappa 2y ago
  It doesn't seem to be from what I can see. Only states that the upload came from a gh runner.
  • woodruffw 2y ago
    See adjacent comment above.
    • guappa 2y ago
      Ok that's at least something. But my CI can download and run code from everywhere, so that doesn't mean that I can know what is being uploaded just looking at the git repository alone.
• woodruffw 2y ago
  Yes, it’s bound to a specific commit; we just don’t present that in the web UI yet. If you click on the transparency log entry, you’ll see the exact commit the attestation came from.