4 ms·
This is fine, but for anyone to be able to actually trust that this person's signed distribution of some piece software is actually safe then you would have to
by CoryG89 11y ago
This is fine, but for anyone to be able to actually trust that this person's signed distribution of some piece software is actually safe then you would have to assume that the person has some way of obtaining the source code from a place that they themselves trust. If they don't write the code and have no access to any other signed version this may be difficult.
- rwallace 11y agoLinux packagers seem to have successfully solved this problem. I imagine it's at least in part because it makes sense for them to put in a bit more effort (e.g. email to the author to make sure they have the right version, if necessary) to save every user having to redo it.