4 ms·
The $505 reward amount is a cute touch. Reading this post lead me to learn about the https://www.sigstore.dev/ https://www.sigstore.dev/ initiative which is
by tux1968 5y ago
The $505 reward amount is a cute touch.
Reading this post lead me to learn about the
https://www.sigstore.dev/ https://www.sigstore.dev/
initiative which is interesting in its own right. Not being able to trust where the software we rely on originates, and hasn't been tampered with along the way, is a weakness that we've been turning a blind eye to, for too long.
- playcache 5y agoagree, sigstore is an awesome project when you delve into the architecture. transparency logs and ephemeral key signing!
- dane-pgp 5y agoYou'll probably enjoy how it is being used to secure the Arch Linux package ecosystem then: https://github.com/kpcyrd/pacman-bintrans https://github.com/kpcyrd/pacman-bintrans
- deleted 5y ago[deleted]