Hacker News new | past | comments | ask | show | jobs | submit login

> - Transparent builds: this should be a standard

Can you explain what "Transparent builds" means in this context?

From my understanding after a quick search, it is the standard. If any package requires me to figure out a manual build process after installing it, to get it to work, I simply do not use it.




This is in related to the publication of the package to npm. All of the publications are verified with provenance statements as supported by NPM directly; it's something I believe all NPM packages should be required to use but as of now it's optional; it simply provided verifiable signatures as to what was built and how it was built.

https://docs.npmjs.com/generating-provenance-statements

https://www.npmjs.com/package/dockview#provenance


Attestation




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: