4 ms·
> There is no fundamental difference between curl .. | sh versus cloning a repo and building it from source. Not true: when you clone a repo with signed commit
by eadmund 7y ago
> There is no fundamental difference between curl .. | sh versus cloning a repo and building it from source.
Not true: when you clone a repo with signed commits, you have forensic evidence that the repo signer provided the code you ran, while when you use curl you have … just the code itself.
That's not a lot, but it's not nothing.
- akerl_ 7y agoHow many repos are there that actually sign commits, and of those, how many users are doing validation that the signer of their local checkout’s commits is actually the key they expected? The line you’ve quoted doesn’t say that there’s no fundamental difference between curl | sh and cloning a repo with signed commits, and I think it’s a stretch to think signed commits have enough usage among devs / users to make them a viable option.
- theamk 7y agoI don't think signing commit matters. What matter is that if webserver is compromised, very few people are likely to notice, and the evidence can be gone at any time. But if github repo is compromised, anyone who pullls the repo can notice strange commits - and the evidence cannot disappear, as public head rebase will bring even more scrutiny.