2 ms·
Maven Central has used PGP for adding "trust" to library authors since the 90's! https://central.sonatype.org/pages/requirements.html#sign-files-with-gpgpgp ht
by brabel 6y ago
Maven Central has used PGP for adding "trust" to library authors since the 90's!
https://central.sonatype.org/pages/requirements.html#sign-files-with-gpgpgp https://central.sonatype.org/pages/requirements.html#sign-fi...
If only people creating new package managers would bother to spend an hour or two learning prior art.
With npm, you can only add "trust" to npm itself LOL: https://docs.npmjs.com/about-pgp-signatures-for-packages-in-the-public-registry https://docs.npmjs.com/about-pgp-signatures-for-packages-in-...
What a joke.
- bayindirh 6y ago> If only people creating new package managers would bother to spend an hour or two learning prior art. No, no... We should move fast and break things. We can implement this in a week because the old dinosaurs are too close minded to implement these things. Today, the hardware is cheap and network is reliable. No need for any safeguards or security features. /s