3 ms·
This is why end-developer signing is essential. This is not as amendable to CI, but that's the point.
by baybal2 6y ago
This is why end-developer signing is essential.
This is not as amendable to CI, but that's the point.
- rmoriz 6y agoAs you see with chrome extensions and android barcode apps, this is not a solution. Developers change or for whatever reasons can change their mind and ship bad things.
- baybal2 6y agoNot a solution to that, but certainly a big impediment for platform attacks.
- HereBeBeasties 6y agoHow does it work in practice, though? For example, create-react-app in NPM has a bajillion deps. Do I trust 8,000 keys? Which ones are OK? I get that you could in principle namespace things (at least for package managers that support this) and insist on a small set of company-internal signing keys for those namespaces. But managing all that isn't easy and what about for package ecosystems that don't really have namespaces (e.g. PyPI, NuGet)?
- baybal2 6y ago> Do I trust 8,000 keys? Which ones are OK? You can at least trust more 8000 developers whose keys are centrally signed, than 8000 packages thrown into signing CI tooling by who knows.