4 ms·
Sorry my mind was just blown that this isn't already in place... this is an APT-sized (advanced persistent threat, not the package manager) hole that makes me w
by password4321 3y ago
Sorry my mind was just blown that this isn't already in place... this is an APT-sized (advanced persistent threat, not the package manager) hole that makes me wonder how many others are still out there.
- woodruffw 3y agoCode signing is the exception, not the norm, in OSS packaging ecosystems. The ones that do already have it tend to have properties that make them amenable to simple implementations, e.g. being able to pre-bake a set of trusted signers into the OS in the case of Debian.