Bas Zalmstra

We have started to use `ahash` instead: https://github.com/conda/rattler/pull/1674

> Given the discussion we've had, I think we need to be a bit more specific on what we mean by "validating" by the receiving server. Does the server reject...

> Where are the attestations stored? It doesnt really matter because attestations can be stored anywhere and be validated from anywhere. Eg the origin of the attestation doesnt matter for...

True! For reference, the pypi predicate also doesnt include any of this information. Its essentially empty. Its just a predicate to be able to sign the subject.

But perhaps that might also not be true for non condaforge channels where there isnt a infrastructure like conda forges availabe.

I noticed that we also see issues here when downloading repodata. RetryMiddleware only retries if there is an issue with either sending the request or when there is an issue...

I think this part is not yet fully exposed. We welcome PRs if you feel up to it!

Thank you so much for taking this on! Would you be able to split the paragraphs into one sentence per line? Now there is a lot of text on a...

Another advantage of storing this information in the repodata is that that information is always readily available during installation, even for already installed records (even if the cache is cleared).

> So what should the behavior be if more than one package in installed with this field set? Good question! I assumed it would be ignored except for the package...