> Signed code reviews and information about other Crev users are called proofs. This is really the other half of the puzzle which projects like sigstore[0] are

> Signed code reviews and information about other Crev users are called proofs. This is really the other half of the puzzle which projects like sigstore[0] are trying to solve. Together they are creating a world where every binary installed on a machine has been reproducibly built from signed source code, with signed reviews, with the hash of each released version published in a public append-only log. A good example of the logging/transparency aspect is the experimental work being done with the Arch Linux package ecosystem.[1] Of course, none of this directly solves the problem of deciding which developers and reviewers to trust, but if mutually distrusting entities each performed their own audits and published the results (perhaps paid for out of countries' cyber-security budgets), it should be possible to give reputation-based guarantees which are at least as good as those which exist for web PKI certificates, for example. [0] https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html https://security.googleblog.com/2021/03/introducing-sigstore... [1] https://github.com/kpcyrd/pacman-bintrans https://github.com/kpcyrd/pacman-bintrans