the garbage that is yaml "builds" is essentially impossible to secure untyped strings, untyped strings everywhere and they're directly executed, with untruste

the garbage that is yaml "builds" is essentially impossible to secure untyped strings, untyped strings everywhere and they're directly executed, with untrusted user input templated in, with full release privileges the entire thing is insane to think pypa deprecated pgp offline signing for this...