Repository navigation
Build the exe on a runner with build provenance - #1
Merged
Merged
Conversation
The 1.1.0 exe was built on my machine and the only thing backing it was a sha256 I pasted into the release notes by hand. That is worth about as much as my word. A windows-latest job that builds it, smoke tests it against the real telecine fixture in a directory with no Python and no source tree, and runs actions/attest-build-provenance gives anyone a chain from the tag to the binary they can check with gh attestation verify. README now says what the unsigned exe looks like on first run, because the people most likely to download it are the ones least likely to have seen that blue box before and shrugged at it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 1.1.0 exe was built on this machine and the only thing standing behind it is a sha256 I pasted into the release notes. A
windows-latestjob builds it instead, smoke tests it against the real telecine fixture from a directory with no Python and no source tree, and runsactions/attest-build-provenance, so anyone can check where the binary came from:It fires on a
v*tag push, and takes arefinput so a tag can be rebuilt by hand.README now says what the unsigned exe does on first run. The people most likely to take the exe route are the ones least likely to have shrugged at that blue SmartScreen box before, and a tool that looks like it might be malware on first contact does not get a second one.
🤖 Generated with Claude Code