4 ms·
Maybe we could start to publish signed approvals of specific package hashes. For example: "I, mbrock, think that pad-left v1.0.3 with hash XYZ seems like an un
by mbrock 11y ago
Maybe we could start to publish signed approvals of specific package hashes.
For example: "I, mbrock, think that pad-left v1.0.3 with hash XYZ seems like an uncompromised release."
Then the tool that upgrades packages could warn when a release isn't trusted by someone you trust (or transitively via some trust web scheme).
The approval system becomes like a "release review" process.
- m_eiman 11y agoThat would probably be doable using a PGP-style trust system. Don't know if it'd add much security in practise though, since the "trust these declarations of trust" decision would most likely be automated.
- mbrock 11y agoYeah, just GPG with Keybase and some place to publish the messages. Trustworthy people wouldn't approve releases automatically... but then, who's trustworthy? Like Pynchon wrote, paranoia is the garlic of life...
- chromakode 11y agoYou still have to decide who to trust, but having a collection of many independent parties verifying a package can be a useful signal even if you don't have anyone directly in your trust chain. It makes it a lot harder for rogue releases to go unnoticed.
- chromakode 11y agoYes! I've been working on this scheme at https://github.com/chromakode/signet https://github.com/chromakode/signet