2 ms·
Linux distros work this way. Some group of people (distinct from sw authors) compile and sign the packages, and distribute them. I guess in this case the code
by megous 6y ago
Linux distros work this way. Some group of people (distinct from sw authors) compile and sign the packages, and distribute them.
I guess in this case the code will not be publicly available, so regular joe will not be able to inspect and recompile.
So rather than app signing, the real issue here is lack of trust for the company.
- yjftsjthsd-h 6y agoAlso, in (most?) Linux distros it's easy to add additional keys to the system's "trusted" list or bypass it completely (AFAIK, `dnf localinstall ./foo.rpm` doesn't care at all about signatures), which makes a significant difference in user freedom IMO.