4 ms·
What about rpm? And then signing it? What's the benefit here?
by staticassertion 5y ago
What about rpm? And then signing it? What's the benefit here?
- bayindirh 5y agoWhen you set your CI/CD pipeline, creating packages, signing them and updating your repositories are all trivial tasks (been there, done that). In this case, explicitly telling "this is my repository and this is the public key. gnupg the key, add this repository line, and get the packages" provides an end to end verified package pipeline. No .sh scripts to compromise. If you keep your private keys on a network detached place and only plug your keys while signing stuff, things are pretty secure out of the box.
- oddmiral 5y agoRPM is much simpler than deb: .spec is just single file with metadata, build recipe, and list of files. Example: https://src.fedoraproject.org/rpms/5minute/blob/rawhide/f/5minute.spec https://src.fedoraproject.org/rpms/5minute/blob/rawhide/f/5m... Signing of packages is used to protect from malware.