4 ms·
This is why signatures should be embedded into the packaging and distribution mechanism, to reduce manual steps. Looking at Dockers deployment of Content Trust
by raesene4 11y ago
This is why signatures should be embedded into the packaging and distribution mechanism, to reduce manual steps.
Looking at Dockers deployment of Content Trust as an example of this.
You still have a trust decision on first use, but it's better protection than nothing.
- kentonv 11y ago> You still have a trust decision on first use, but it's better protection than nothing. That's what you're getting by curl|bashing sandstorm today (if you skip the PGP verification step). Once installed the updater verifies signatures automatically.