3 ms·
> This feels like this might actually be a use-case for a blockchain or a Merkle Tree. Merkle trees sure but you do not need a blockchain to store/manage hashe
by treyd 3y ago
> This feels like this might actually be a use-case for a blockchain or a Merkle Tree.
Merkle trees sure but you do not need a blockchain to store/manage hashes of sources and build products. Just have trustworthy parties attest that source commits yield particular binaries by their hashes and publish those signatures somewhere. Even Bitcoin Core does something like this using PGP.
- c-linkage 3y agoThe only reason for suggesting a block chain is that the information should be publicly available without having to visit a specific vendor's web site for confirmation. But maybe it's not necessary. DNS Root Zones, for example, are publicly accessible and well managed (maybe not the registrars, but the registry) so perhaps a well-funded third party could establish a trusted, global, registry for supply chain Merkle Trees.