3 ms·
WAPM already has a mechanism for signed packages (although not through Sigstore, first time I'm hearing of it but thanks for the reference!) You can read more
by syrusakbary 5y ago
WAPM already has a mechanism for signed packages (although not through Sigstore, first time I'm hearing of it but thanks for the reference!)
You can read more about it here:
https://medium.com/wasmer/securing-wapm-packages-with-package-signing-3cf0d12f32f3 https://medium.com/wasmer/securing-wapm-packages-with-packag...
- no_circuit 5y agoIMO just signing packages is a weak form of trust. Even without potentially using Sigstore, does WAPM now let you lock based both on the versions of dependencies, as well as the hash of their contents? I didn't see any mention of lock files with hashes anywhere.