Skip to content

Conversation

@woodruffw
Copy link
Member

Made some small tweaks, to link to more things where possible and specialize the handling of kind == GitHub publishers (since that's what the MVP supports).

Example:

Screenshot 2024-11-12 at 5 17 05 PM

Signed-off-by: William Woodruff <[email protected]>
@woodruffw woodruffw requested a review from a team as a code owner November 13, 2024 00:17
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
@miketheman miketheman enabled auto-merge (squash) November 13, 2024 21:21
@miketheman miketheman merged commit 932cbbd into pypi:main Nov 13, 2024
20 checks passed
@miketheman miketheman deleted the ww/details-tweaks branch November 13, 2024 21:29
{% macro publisher(publ) -%}
{% if publ.kind == "GitHub" %}
<p>
Publisher: <a href="https://github.com/{{ publ.repository }}/blob/HEAD/.github/workflows/{{ publ.workflow }}">
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@woodruffw Do we not have the SHA or some other ref to link to instead here?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do, although it's packed into the X.509 extensions within the attestation's certificate. I'll do a follow-up PR to extract and present that (along with the other useful stuff at the X.509 layer).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tracking: needs pypi/pypi-attestations#70

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants