19 ms·

Maven central will let you sign artifacts with any published key you like, but one thing you can do in theory, is verify that new releases are signed by the sam

Maven central will let you sign artifacts with any published key you like, but one thing you can do in theory, is verify that new releases are signed by the same key as a known good release. I am not aware of anyone actually doing this though.

yarg 6y ago
That approach is still vulnerable to what amounts to a MITM attach: a bad actor can simply provide the legitimate versions for whatever period he deems required to build trust.