Did I just hack up an abomination using xmllint (from libxml2) and jq to query the latest #PyPI version of a package? Perhaps. Do you no longer have to specify the target version when using pkgbump on PyPI packages? Absolutely. #Gentoo
I've finally found a valid use case for #PyPI attestations: the provenance check lets me find wrong case in #GitHub URLs. Like, if the user is "FooBar", GitHub just lets me use "foobar" in the URL and doesn't correct it in any way, but provenance check will fail!
@mgorny@social.treehouse.systems