3 ms·
Just to reiterate the parent: This is only valuable if we trust the signatures - which I wouldn't if they were, say, just held along side the "hacked" gems serv
by ikawe 14y ago
Just to reiterate the parent: This is only valuable if we trust the signatures - which I wouldn't if they were, say, just held along side the "hacked" gems server.
- rmc 14y agoI'm talking g about developers signing the archive on their local machine. Private key would be stored on developers laptop
- Xylakant 14y agoYou still need the public key to validate the signature. If the attacker can change the public key, he can change the signature without you knowing - unless you explicitly want to trust each and every key for every gem you install.