With microlibraries and such, updates and maintainership and security become a nightmare. I would like to pull from your repo (rather than vendor), while only accepting maintainership and releases performed by you. Note that this is not considered an obligation of maintenance, just selective recognition of future releases to known quantities.
In essence, I am asking that you sign a single non-git artifact (e.g. the min js).
I am happy to enable such functionality through a CI mechanism, that would then be handed off to you after a draft/POC. This could be generally applicable to the polyfills or other work that you publish.
With microlibraries and such, updates and maintainership and security become a nightmare. I would like to pull from your repo (rather than vendor), while only accepting maintainership and releases performed by you. Note that this is not considered an obligation of maintenance, just selective recognition of future releases to known quantities.
In essence, I am asking that you sign a single non-git artifact (e.g. the min js).
I am happy to enable such functionality through a CI mechanism, that would then be handed off to you after a draft/POC. This could be generally applicable to the polyfills or other work that you publish.