Release trust page: a compact graph, and badges where a build is signed and attested issue #79
closed: completed andymccall opened this · 0 comments
andymccall
On /OWNER/NAME/releases/trust/TAG the graph fills the screen: huge boxes and type for a few nodes (Andy's screenshot of oxygenhub v0.3.0). Wanted:
a compact graph sized to its content (normal text size, boxes to fit, no empty middle column when no job built the assets);
clear marks of trust on each part: a lock or badge on the tag when it is signed (and by whom), on each author when their changes are signed by a linked key, on a job when its receipt is signed by a known runner, and on an asset when an attested OxygenFlow job produced exactly those bytes; a warning badge on an asset uploaded by hand;
a one-line summary at the top: e.g. 'Tag signed by Andy McCall · 0 of 8 assets built by OxygenFlow'.
Related: 0.3.0's assets were built on the workstation and uploaded, so none is attested; building release assets in OxygenFlow would make them so.
On /OWNER/NAME/releases/trust/TAG the graph fills the screen: huge boxes and type for a few nodes (Andy's screenshot of oxygenhub v0.3.0). Wanted:
Related: 0.3.0's assets were built on the workstation and uploaded, so none is attested; building release assets in OxygenFlow would make them so.