← Back to context Comment by frabcus 1 month ago Have any kind of provenance. eg like Debian has for 30 years. Key signing in person etc 1 comment frabcus Reply tpetry 1 month ago That has also been implemented recently. With staged publishing the author must verify a new release with 2FA so automated attacks dont work anymore. Some human in the loop must verify a release.
tpetry 1 month ago That has also been implemented recently. With staged publishing the author must verify a new release with 2FA so automated attacks dont work anymore. Some human in the loop must verify a release.
That has also been implemented recently. With staged publishing the author must verify a new release with 2FA so automated attacks dont work anymore. Some human in the loop must verify a release.