4 ms·
CII' FOSS best practices criteria
- dane-pgp 5y agoIt's good that having a reproducible build process is a requirement for the Gold rating, as is signed releases. Perhaps there needs to be a Platinum level which involves storing the hash of each release in a distributed append-only log, with multiple third parties vouching that they can build the binary from the published source. Obviously I'm thinking of something like sigstore[0] which the Arch Linux package ecosystem is being experimentally integrated with.[1] Then there's Crev for distributed code review.[2] [0] https://docs.sigstore.dev/ https://docs.sigstore.dev/ [1] https://github.com/kpcyrd/pacman-bintrans https://github.com/kpcyrd/pacman-bintrans [2] https://github.com/crev-dev/crev https://github.com/crev-dev/crev