4 ms·
Except that this does not really give you that much security. Maybe only in the transport, but certainly not verification of content. HTTPS (or SSL/TLS for tha
by jvdh 12y ago
Except that this does not really give you that much security. Maybe only in the transport, but certainly not verification of content.
HTTPS (or SSL/TLS for that matter) only verifies the identity of the server the content is coming from. Since users can upload stuff to repositories on Sonatype, there is no verification of content whatsoever.
A naive workaround of this is to use PGP signed content. This would work, if users actually verified the PGP signature through a third channel. Either using web of trust, or some other means of getting a verification that the PGP key actually belongs to the developer.
Failing that, HTTPS is just snake-oil security here.
- rx4g 12y agoNo measure taken in isolation will give you "that much security". As you say, validating the identity of the artifact signer is an extremely important and oft-missed measure, but that should not lead one to conclude that transport layer security (both confidentiality and server authentication) is unimportant or "snake oil". I will give you that web PKI sucks, but I would rather have a bit more assurance (even if imperfect) that the site I'm pulling artifacts from is indeed the one I intended to retrieve them from, even if I have a good signature + signer verification mechanism in place.