So would a user have to do some kind of `gh attestation verify PATH/TO/YOUR/BUILD/ARTIFACT-BINARY ...`? (assuming the plugin dev provides an sbom?)

To check if any community plugin is safe, it seems like you'd have to not only review the code on github, but also analyze the github release files to be sure nothing malicious packed in there.

Maybe I'm misunderstanding something about the process, I'd appreciate if anyone could confirm or explain otherwise.

I'm curious to what limit you can randomly replace words and reverse it later.

Even with code. Like say take the structure of a big project, but randomly remap words in function names, and to some extent replace business logic with dummy code. Then use cloud LLMs for whatever purpose, and translate back.

Google's Recorder app makes this a big PITA if I don't want to enable upload to cloud storage, there is a very tedious manual way to export recordings.

I really just want plain old data and to be able to copy or delete files via the filesystem. And not be required to use some cloud service.

running a VM just for occasional office use is annoying to deal with

edit: activation is probs the main issue

> The Docker image includes clang-p2996, Bloomberg’s experimental Clang fork that implements the reflection proposal. As P2996 moves toward standardization, expect this to land in mainline compilers.

Possible to use that C++26 compiler just to do code generation for the binding code, and then use any other compiler for your actual build? I suppose alternatively could use a parser. Is the reflection code easy to work with in comparison? A year or two ago I spent some hours pulling my hair out trying to do some reflection in C++ until I gave up and spent the 20mins needed to write a python script to read my source files and do the code generation I needed.

per https://zorin.com/os/