You aren’t just trusting the authors though. You’re trusting that no other step in the chain has been tampered with or compromised somehow.

Were they sticking their head out the window to see?

There’s a surprising number of nazis who unsurprisingly support nazis and don’t think they’re bad.

It’s a sad world lately.

6 months would be reasonable, I see a lot that are 30 days or something similar

I like the approach of ci pipelines just running a make command or at least a script, so that it’s easy to run locally too before pushing the changes up.

Do you put the version in each commit? That seems painful

You’ll need to include new instructions to follow too!