3 ms·
Still an improvement. Keys can be revoked and regenerated.
by d4mi3n 5y ago
Still an improvement. Keys can be revoked and regenerated.
- Joker_vD 5y agoSo can be the published packages? And the developer accounts' passwords?
- d4mi3n 5y agoRevoking the keys makes whatever existing artifacts and packages signed with old keys fail integrity checks. Revoking the published packages and rotating compromised passwords should certainly also be done, but neither of those stop packages in mirrored or present in local caches from being used without further intervention (assuming your packaging ecosystem regularly verifies packages have valid signatures, which sadly I know ecosystems like NPM do not).