4 ms·

Ask HN: Reputable code signing service? For arbitrary payloads

• warrenm 5y ago
  Who would be willing to take the risk of signing "arbitrary payloads"?! Unless you've got the Sultan of Kinakuta standing by ... this seems like an extraordinarily bad idea
  • verdverm 5y ago
    Verifying who signed a binary is important as verifying the bits haven't changed. You can then choose to trust different signatories and doesn't mean you trust without verification.
    • warrenm 5y ago
      So you're saying this is merely a digital notary? "Yeah, JellyBubble17 signed this"?
• verdverm 5y ago
  Have a look at Sigstore and their tool cosign. It's aiming to be the Let's Encrypt of code signing. I'm not sure if arbitrary binaries are supported fully yet, but it's being worked on. https://github.com/sigstore/cosign https://github.com/sigstore/cosign