3 ms·
Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.
by lorecore 5mo ago
Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.
- skydhash 5mo agoOwn domains is the real deal. My preffered model is tarball releases with checksums, or better yet, with signatures (like remind[0] or msmtp[1]). Such pages are trivial to host properly and loads quickly. [0]: https://dianne.skoll.ca/projects/remind/ https://dianne.skoll.ca/projects/remind/ [1]: https://marlam.de/msmtp/download/ https://marlam.de/msmtp/download/
- account42 5mo agoI was confused for a bit what those two projects have to do with signatures but I guess you are just using them as examples of having (PGP) signatures for downloads?