Hi, On Thu, Jan 17, 2019 at 10:04:01AM +0100, Hervé Boutemy wrote: > Hi, > > After the work on jvm buildinfo [1], the discussion on rebuilder attestations > showed that Maven central could be seen as some sort of Linux distribution: > it > has some specific aspects (multi-platform, multi-version for each project), > but it shares the fact that someone must write a rebuild specification for > everything to be able to automatically execute rebuilds, and these rebuilds > will generate buildinfo.
I'm a little surprised that you dismissed in-toto for this specific reason. in-toto is being used today to create platform-agnostic supply-chain attestations for everything, from single files to whole container images. I'm not against re-inventing the wheel or having competing ideas, but it seems to me that avoiding xkcd 927 would be a good idea. Thanks, -Santiago
signature.asc
Description: PGP signature
_______________________________________________ [email protected] mailing list To change your subscription options, visit https://lists.reproducible-builds.org/listinfo/rb-general. To unsubscribe, send an email to [email protected].
