franzap on Nostr: Definitely agree that attestations can't be placed on mutable events. > What if the ...

Definitely agree that attestations can't be placed on mutable events.

> What if the author accidentally included a binary from the previous release? the hashed file would still have trust attestations attached.

Doesn't this go against your point? If the author accidentally points to a wrong binary in a mutable release set event, they can update it.

A user cares about finding an attestation for the actual thing they're installing.