We have 7d cooldown on packages on an internal pypi proxy but that blocks security updates also, which we now have to manually exclude from the cooldown.
I’m unsure how to automate this properly, maybe an LLM is the best starting point.
I’m unsure how to automate this properly, maybe an LLM is the best starting point.
There needs to be a service that does reproducible builds of opensource projects as they sit and publishes results for people to scrape freely.
To be robust itself against attacks, likely 3-4 services.
But then that needs funding to be sustainable … and companies are incredibly cheap. Especially right now. As such… shrug :(
Maybe something as a skill for LLMs to run that actually checks build reproduction from source for a project and all of its dependencies? But then that’s gonna burn some tokens ….
I do this for personal projects … but at work they’ve started rationing tokens… as such… idk?
Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.