DanConwayDev on Nostr: I was trying to make the case for trust attestations made against releases rather ...

I was trying to make the case for trust attestations made against releases rather than binaries like what happens with gpg signatures today. I'm coming around to them just being made against pubkeys, app profiles and binaries.

Given that franzap (nprofile…vpy4) has already been building with mutable releases, I don't think there is a strong enough argument here to warrant a change.