3 ms·
HTTPS only protects the transmission from repository to user. It doesn't protect the package in the repository.
by jacques_chester 4y ago
HTTPS only protects the transmission from repository to user. It doesn't protect the package in the repository.
- klysm 4y agoYeah but what trust system are you going to use for that? I don’t see how anything at scale buys you too much
- pabs3 4y agoThe Linux distros use OpenPGP/X.509 keys stored on HSMs for their archive security, and a set of per-maintainer keys that are used to verify changes to the archive. RubyGems/Cargo/etc could use something like that.