bf46cbf073
Rust PoC (cargo, packages.d/*.toml config) that checks astral-sh/uv's GitHub Atom feed for a new release, fetches the matching asset via the GitHub API, and verifies it. Confirmed live against the real repo: uv actually ships GitHub build-provenance attestations (sigstore bundle) on every release, so it's a tier-2 package, not the tier-4 same-origin-sha256 guessed in the original spec draft. Verified via `gh attestation verify` rather than reimplementing sigstore in Rust. State persists across runs so a second run correctly reports "up to date." Also folds the finding back into SPEC.md: updates the uv example to tier 2, derives tier from verification method instead of storing both (avoids a tier/method mismatch that would mean nothing), marks the packages.d/ layout question resolved, and updates Architecture/Status to say what's actually implemented vs. still sketch (build/publish/review queue, same-origin-sha256 against a live repo, scheduling, non-GitHub sources, minisign are all still open). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A2FEut5tVMNjeVjqhgVZbr
12 lines
504 B
TOML
12 lines
504 B
TOML
# Verified 2026-09-11: astral-sh/uv publishes GitHub build-provenance
|
|
# attestations (sigstore bundle, `gh attestation verify` passes) for every
|
|
# release asset — tier 2, not the tier-4 same-origin-sha256 originally
|
|
# assumed in SPEC.md's draft example. Per-asset .sha256 files also exist
|
|
# but aren't used here since the attestation is strictly stronger.
|
|
|
|
[package.uv]
|
|
repo = "astral-sh/uv"
|
|
asset_pattern = "uv-x86_64-unknown-linux-gnu.tar.gz"
|
|
|
|
[package.uv.verification]
|
|
method = "github-attestation"
|