Fridolín Pokorný
Fridolín Pokorný
Nice research. Sadly, these hashes will not be part of the artifacts as the artifact hash is computed based on the artifact content, which makes it a chicken-egg problem. As...
Looking into this issue, it might be better to have security information on the backend side linked to the container image SHA (and let clients ask for it). If you...
/remove-lifecycle stale
/remove-lifecycle stale
Part of the planned intern project.
BTW it might be also good to check if this data source would be suitable for solver rules to automatically block malicious packages based on OpenSSF's scans.
It might be a good idea to wait for upstream to establish signing artifacts before proceeding with this one - see [PEP-480](https://www.python.org/dev/peps/pep-0480/). Let's wait for upstream implementation for this and...
Related: https://github.com/thoth-station/core/issues/366
We have discussed an approach that would reuse logic for template projects. Let's sync if we want to develop and maintain this type of logic in Kebechet.
CC @codificat @goern do we want to start work on this one? It might take some time to have this available.