3 ms·
Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced.
by lrvick 1mo ago
Arch at least mandates author signed packages which is unfortunately rare these days, but keys do not need to be on smartcards, and code review is not enforced. You compromise the right arch maintainer and you could do some real damage.
Arch is second only to Guix in terms of supply chain security for desktop distributions, but both still have a threat model that cannot tolerate a single laptop compromise.
Stay tuned for stagex for workstations. https://stagex.tools https://stagex.tools
- NekkoDroid 1mo agoI do know some of the arch maintainers (e.g. dvzrv IIRC) are working on build infrastructure that would completely automate the build process and HSM signing to separate read-only images on build servers[0, 1, 2]. I haven't heard about updates to buildbtw in a while, but development seems still somewhat active and signstar is mentioned now and then at some conferences. It feels like it is not making any progress, but I don't pay any attention to the development, so it is likely just my perception of it just having been waiting on visible process to it and not seeing it. [0]: https://gitlab.archlinux.org/archlinux/signstar https://gitlab.archlinux.org/archlinux/signstar [1]: https://gitlab.archlinux.org/archlinux/signstar-os https://gitlab.archlinux.org/archlinux/signstar-os [2]: https://gitlab.archlinux.org/archlinux/buildbtw https://gitlab.archlinux.org/archlinux/buildbtw
- lrvick 1mo agoI am aware of their work, and while this is better than the status quo, it does even come close to my threat model of "trust no single computer or machine" which is what I must support.