3 ms·
Isn't signing supposed to solve some of that? You sign the binaries you host on your site, and the OS checks to make sure the signature is valid. (Maybe against
by jerrac 8y ago
Isn't signing supposed to solve some of that? You sign the binaries you host on your site, and the OS checks to make sure the signature is valid. (Maybe against a non-profit "Let's Sign".) If it's a valid signature, then you know it was signed by someone your OS trusts. Ideally, the OS would not trust signatures from malicious actors.
I've never been involved with that kind of thing, so I'm just guessing. Feel free to correct me.
- pjmlp 8y agoThere have been cases where malware authors were able to change package contents while keeping the signature.
- Dylan16807 8y agoWhat kind of package? That probably means the signing is way too complicated. There's not much to get wrong in doing a single hash of an entire zip package and then appending a simple signature of that hash.