4 ms·

You could say this about any service serving software artifacts?

• sneak 3y ago
  Unsigned ones, yes.
  • pkage 3y ago
    That just moves the trust requirement up the chain, and assumes that the image wasn’t compromised pre-signing (either intentionally or unintentionally)
    • jabradoodle 3y ago
      It doesn't, it removes/reduces one step, and leaves another one that is there regardless.