3 ms·
It s very easy: add a dev signature in the repo that cannot be changed ever, and force the devs to sign their stuff before allowing a change of binary or a down
by secondaryacct 5y ago
It s very easy: add a dev signature in the repo that cannot be changed ever, and force the devs to sign their stuff before allowing a change of binary or a download.
Like that you can have anything trying to upload but fail the signature check.
- nathanaldensr 5y agoThis assumes that the developers themselves are not malicious (see: left-pad) and that their signing keys can't be stolen.