2 ms·
There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-
by woodruffw 3y ago
There are lots of systems (and ecosystems) where host trust doesn’t matter, like containers or language-specific package management. Sigstore is currently well-suited for those contexts.
With a self-signed certificate, you are effectively your own PKI. The goal is generally to deduplicate that kind of work while also providing better security properties than “my host trusts self-signed certificates from a root CA that I keep on disk somewhere.”
- fragmede 3y agoWell the assumption is that the root CA stores them more safely than "on my laptop in my unlocked bedroom in an unassuming neighborhood of brighton" that most developers lean on for their secret storage, but, well, you never know.
- snnn 3y agoA more specific example: nuget allows pinning the certs. https://learn.microsoft.com/en-us/nuget/reference/nuget-config-file#trustedsigners-section https://learn.microsoft.com/en-us/nuget/reference/nuget-conf... I feel signing a nuget package with a self-signed cert is not worse than any PGP signing method in term of trust level. They both are identified by a crypto fingerprint and you have to manually get the fingerprint from somewhere and just trust it. I do not see a big difference there.