Hopefully the attestation is bound to a specific commit, so you can know the bin...

		remram 4 hours ago \| parent \| context \| favorite \| on: PyPI now supports digital attestations Hopefully the attestation is bound to a specific commit, so you can know the binaries came from the source? Otherwise I don't get it.