Why can't package managers enforce attestations backed by a transparent log for each commit made to a public repository?

They can, but what does it solve? If a malicious package gets pushed, who or what is the equivalent of the CA that you are you going to nuke?

	▲	rishabhaiover 4 hours ago \| parent [-]
		I was working with the assumption in this model the attestation is signed by ephemeral keys (OIDC) which would reveal the bad actor or give breadcrumbs. Enough to reduce incentives to hijack packages.

dboreham 4 hours ago | parent | prev [-]

They can but that wasn't done in this case and isn't commonly done for various reasons.