Attestation

[tsteven4]

No description provided.

[robertlipe]

I know very little about this, but shouldn't we be signing only the executables in releases and not. Nifjtlies or build artifacts?

…

On Sun, Nov 10, 2024, 3:34 PM tsteven4 ***@***.***> wrote: Merged #1376 <#1376> into master. — Reply to this email directly, view it on GitHub <#1376 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACCSD3ZHEMIO7TXHHZ244O3Z77GN5AVCNFSM6AAAAABRQS5LEWVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJVGI2DEMJQGAZTMNA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[tsteven4]

I'm trying to generate attestations for the Continuous Release installers, not the build artifacts. Unfortunately this stuff only runs after the PR is merged into master. When we do a release it would be nice if we had attestations for those builds, but that will mean absolutely no post build changes are allowed, and we will need to make sure the release images have attestations. At this point I just aiming for the Continuous releases.

[GPSBabelDeveloper]

I defer to your wisdom. Perhaps we move to a model of a branch for release (candidate) builds and attest those and not all the nighrlies and presubmits. There was some other case that would simplify. But, again, I defer. I'm just saying we don't always have to stick with The Way it's Always Been.

…

On Sun, Nov 10, 2024, 4:17 PM tsteven4 ***@***.***> wrote: I'm trying to generate attestations for the Continuous Release installers, not the build artifacts. Unfortunately this stuff only runs after the PR is merged into master. When we do a release it would be nice if we had attestations for those builds, but that will mean absolutely no post build changes are allowed, and we will need to make sure the release images have attestations. At this point I just aiming for the Continuous releases. — Reply to this email directly, view it on GitHub <#1376 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AC3VAD2IU4ZXNVFKGV6UKATZ77LPTAVCNFSM6AAAAABRQS5LEWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINRWHE2TOOBXHA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>