3 ms·
> If you don't know a project's maintainers and you trust GitHub then this model lets you verify the maintainers' work by looking at the source, I'm not sure I
by traceroute66 5y ago
> If you don't know a project's maintainers and you trust GitHub then this model lets you verify the maintainers' work by looking at the source,
I'm not sure I follow.
GitHub is basically a glorified git repo.
So I still have to trust the people who do the git push, no ?
If so, then I fail to see how you can do better than git PGP signing ?
git PGP signing enforces integrity at the basic level, so you've got a chain of signed git commits.
I don't understand the "trust" in saying, "well, we've got too many maintainers to track PGP keys, so instead anybody can commit and we'll abstract the trust away to the build-level where we trust Github to build it without tampering, and we trust someone else to sign it" ... because that's what I read it as.
- woodruffw 5y ago> git PGP signing enforces integrity at the basic level, so you've got a chain of signed git commits. PGP has a handful of issues: you’re now trusting maintainers to manage long-lived signing keys, and you now have to manage your own trusted ring of signers. Both of these break down when dealing with package management ecosystems without a curating authority (e.g., a Linux distribution). (That’s also assuming people actually verify their Git repositories, which I’ve never seen. It also assumes that people make reasonable key selection choices for PGP, which has been a problem in he past.)
- skybrian 5y agoSpecifically it protects against someone releasing a binary that doesn't match the source. If you can't trust that the binary was built the normal way then you either have to ignore the source and analyze the binary, or build it yourself.