Midway Arcade Origins looks like the most recent non MAME compilation.

en.wikipedia.org/wiki/Midway_...

But I do love the MAME team’s dedication to preserving our gaming heritage

Have you got all the games lined up on MAME?

Good stuff, though I can't believe you got through it with just a single mention of SBOM.

Maybe a follow up with hachyderm.io/@vpetersson who's a friend of RedMonk and very active in that space?

Thanks. I'm starting to think the right compromise (at least for READMEs explaining how to verify) is something like:

--certificate-identity-regexp='^https://github.com/org/repo/.+'

Which will test that it came from where you'd expect (and further details are their in the JSON if needed).

@adrianmouat.com I finally got around to trying this.

When verifying with cosign what do you use for your --certificate-identity flag?

Looks like this was something that used to 'just work' in earlier versions, but now the UX is much less friendly, presumably in the interests of securitay.