Comment Re:Google (Score 3, Insightful) 6
So do it yourself. Honestly, this kind of kneejerk response is stupid. Is Google a good company? No. Does that mean everything they do is useless/untrustworthy? Also no.
You can fetch OSS Rebuild's SLSA Provenance:
$ oss-rebuild get cratesio syn 2.0.39
or explore the rebuilt versions of a particular package:
$ oss-rebuild list pypi absl-py
or even rebuild the package for yourself:
$ oss-rebuild get npm lodash 4.17.20 --format=dockerfile | docker run $(docker buildx build -q -)