I said digital attestations and `pylock.toml` would have helped with the litellm attack. People asked for more details, so I wrote a blog post explaining why. It also hopefully acts at motivation for people to use:
- Trusted publishing
- Digital attestations
- Lock files, and `pylock.toml` specifically
https://snarky.ca/why-pylock-toml-includes-digital-attestations/
So yes, Juan Nunez-Iglesias (npub1ks8…5wm6) , I have a "human-readable intro" because I wrote one for you (and the other folks asking me questions on the subject). 😁
do you have a human- (read: noob-) readable intro to these concepts? I don’t think we use pylock in any of the projects I lead. 😬