4 ms·
Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!
by uxp8u61q 3y ago
Wait, their certificates aren't trusted by the os? What's the point of their service, then? A self-signed certificate accomplishes the same result!
- woodruffw 3y agoThere are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts. With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA that I keep on disk somewhere.”
- fragmede 3y agoWell the assumption is that the root CA stores them more safely than "on my laptop in my unlocked bedroom in an unassuming neighborhood of brighton" that most developers lean on for their secret storage, but, well, you never know.
- snnn 3y agoA more specific example: nuget allows pinning the certs. https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#trustedsigners-section https://learn.microsoft.com/en-us/nuget/reference/nuget-conf... I feel signing a nuget package with a self-signed cert is not worse than any PGP signing method in term of trust level. They both are identified by a crypto fingerprint and you have to manually get the fingerprint from somewhere and just trust it. I do not see a big difference there.
- warent 3y agoThe landing page linked above gives a pretty detailed write-up about the point of their service