3 ms·
A good first step would be to have signatures and verification. There's definitely room for overlay package managers (as he calls them), if only because they w
by Juliate 4y ago
A good first step would be to have signatures and verification.
There's definitely room for overlay package managers (as he calls them), if only because they work _across_ systems mostly, and they have a higher release cadence, which is marginally useful for stable, proven apps releases, but is definitely helpful for development and experimentation.
- jka 4y agoSignatures by what participants, and at what stage(s) of the software development lifecycle?
- Juliate 4y agoBy the person acting the release of a new version on the public repository (like any maintainer would do).
- jka 4y agoThanks - agreed, release manager signatures are nice to have. The reason I ask is that I think it'd be nice if third parties could also voluntarily sign releases. For example: the author of a library -- or one of their users -- could fund a security audit of a specific version, and then the auditors could sign to attest their findings (issue and severity count, perhaps) in a way that's visible to package users via the command-line and web. It'd add useful information for people trying to select appropriately-secure code, and also help foster a marketplace for open source security code review.