Add release atteststions

[orf]

Hello!

First, thanks for this fantastic project - it’s a great help to the community and ecosystem at large.

I would like to suggest adding artifact attestations to the releases.

This would enable supply chain verification for these builds, and provide a layer of validation above just verifying the signature.

it’s pretty simple to add: just a single step, with no configuration or changes required in the binary itself.

what do you think?

[zanieb]

Yeah these seem reasonable, were you interested in contributing this?

[orf]

Absolutely! I’m currently travelling and away from my laptop so it will have to be next week, but I can take a look at it when I’m back.

[chludwig-haufe]

I see there is an open PR #371, but no further activity. Is there anything blocking the creation of the attestations?

Since I didn't see this mentioned in the documentation: How is the integrity of the Python sources and dependencies used in the build verified?

[indygreg]

We pin and verify the sha256 and file size of all downloaded assets. See downloads.py.

[zanieb]

@chludwig-haufe there's a blocking comment at #371 (comment)

[orf]

@chludwig-haufe there's a blocking comment at #371 (comment)

Yep! I have this PR in my backlog, but some personal stuff has come up.

We should indeed only attest on main (or anything that actually publishes), adding the relevant if: blocks should be all that is needed.