4 ms·
Absolutely agree that it is disturbing that this isn't a priority. Necessary, but still not sufficient - I suspect the attack model will just move to buying/st
by _jal 5y ago
Absolutely agree that it is disturbing that this isn't a priority.
Necessary, but still not sufficient - I suspect the attack model will just move to buying/stealing keys.
- d4mi3n 5y agoStill an improvement. Keys can be revoked and regenerated.
- Joker_vD 5y agoSo can be the published packages? And the developer accounts' passwords?
- d4mi3n 5y agoRevoking the keys makes whatever existing artifacts and packages signed with old keys fail integrity checks. Revoking the published packages and rotating compromised passwords should certainly also be done, but neither of those stop packages in mirrored or present in local caches from being used without further intervention (assuming your packaging ecosystem regularly verifies packages have valid signatures, which sadly I know ecosystems like NPM do not).