Félix Saparelli
Félix Saparelli
In the `- uses: cargo-bins/cargo-binstall@main` workflow you mean? The other problem is once we've got the public key, how to check the signatures against it without introducing more links in...
In fact, the guaranteed presence of node.js in GHA makes me think that perhaps a solution (if a bit of an overengineering?) is to make a WASI build of cargo-binstall...
Or, hey, here's a fun one, we use [the build from quickinstall](https://github.com/cargo-bins/cargo-quickinstall/releases/tag/cargo-binstall-1.4.1) which is signed with the single/static quick-install key, which we can embed, and now we only need to...
But probably the easiest thing is to pin the initial download to a particular cargo-binstall version and embed in the script the list of all sha256 hashes for the binaries...
> Ah, I only just now noticed you're on Linux 😅. That explains why I couldn't find the log again (I was searching for the Windows log line). Given that...
Re-opening as the dSYM folder in the packaging is empty on mac builds, and the pdb is just not there for windows builds >:(
Yeah, that's more like it: 
I'll figure out the windows thing when I test #650 this weekend
Yeah, it's definitely a 1.3.1 thing; 1.4.1 is in install-action `@main` but not yet in a released version
Yeah, I think there's two action items here: 1. We should build our own musl builds with +crt-static (optional, but probably wise to avoid breaking expectations) 2. We should change...