The plan here is to provide as much information as possible to give users trust in the artifacts (that they are faithful compilations of the upstream sdist, and neither I nor anyone else has tampered with them)
Use a lockfile for both build and cibuildwheel
(Investigate reproducibility of cibuildwheel
Log/upload the Workflow YAML itself
Log/upload information about the upstream sdist (URL, sha256, etc...)
The plan here is to provide as much information as possible to give users trust in the artifacts (that they are faithful compilations of the upstream sdist, and neither I nor anyone else has tampered with them)
build
andcibuildwheel
cibuildwheel