3 ms·
PGP signing of packages should be table stakes for publishing to a public repository. If unsigned packages are accepted by a public repository to reduce fricti
by rectang 6y ago
PGP signing of packages should be table stakes for publishing to a public repository. If unsigned packages are accepted by a public repository to reduce friction for newbies, such packages should be hidden by default.
Then, build tools should be configurable such that they only pull in dependencies signed by PGP keys drawn from a whitelist.
Finally, companies need to maintain private repositories of vetted dependencies and avoid pulling from public repositories by default — and this requirement needs to be configurable from the project's build spec and captured in version control.
- angry_octet 6y agoIf you've seen the PGP/GPG code you'll know what a trash fire it is, and if you follow its development you'll see how unfriendly the maintainers are when bugs are pointed out. Adding dependencies on PGP just makes everything worse. X.509 PKI for code signing is also terrible and very very complicated and error prone. Also consider the community nature of development. You need to handle all sorts of painful crypto issues now.