3 ms·
Essentially, yes. And that means duping a developer into adding your code somehow, since builds are digitally signed with a hardware token.
by smileybarry 3y ago
Essentially, yes. And that means duping a developer into adding your code somehow, since builds are digitally signed with a hardware token.
- dzikimarian 3y agoOr supply chain attack
- smileybarry 3y agoBut that requires it to be present before the build is signed, ergo, early in the supply chain. Otherwise, the signature breaks and the build isn’t trusted for the rest of it.