Though for the past few years I've been using a North Face Vault for such trips, and I still love it.

www.thenorthface.com/en-gb/p/bags...

For recent Barcelona trip I took the Vault and wife used the Mous.

One consideration might be the 45x36x25cm 'personal item' dimensions that have become standard on European carriers.

Given that limit (and a recommendation from a friend), I recently got a Mous Optimal Protective Lid Backpack uk.mous.co/products/pro...

Midway Arcade Origins looks like the most recent non MAME compilation.

en.wikipedia.org/wiki/Midway_...

But I do love the MAME team’s dedication to preserving our gaming heritage

Have you got all the games lined up on MAME?

Good stuff, though I can't believe you got through it with just a single mention of SBOM.

Maybe a follow up with hachyderm.io/@vpetersson who's a friend of RedMonk and very active in that space?

Thanks. I'm starting to think the right compromise (at least for READMEs explaining how to verify) is something like:

--certificate-identity-regexp='^https://github.com/org/repo/.+'

Which will test that it came from where you'd expect (and further details are their in the JSON if needed).

@adrianmouat.com I finally got around to trying this.

When verifying with cosign what do you use for your --certificate-identity flag?

Looks like this was something that used to 'just work' in earlier versions, but now the UX is much less friendly, presumably in the interests of securitay.