13 lines
504 B
TOML
13 lines
504 B
TOML
|
# Verified 2026-09-11: astral-sh/uv publishes GitHub build-provenance
|
||
|
|
# attestations (sigstore bundle, `gh attestation verify` passes) for every
|
||
|
|
# release asset — tier 2, not the tier-4 same-origin-sha256 originally
|
||
|
|
# assumed in SPEC.md's draft example. Per-asset .sha256 files also exist
|
||
|
|
# but aren't used here since the attestation is strictly stronger.
|
||
|
|
|
||
|
|
[package.uv]
|
||
|
|
repo = "astral-sh/uv"
|
||
|
|
asset_pattern = "uv-x86_64-unknown-linux-gnu.tar.gz"
|
||
|
|
|
||
|
|
[package.uv.verification]
|
||
|
|
method = "github-attestation"
|