Re:Nix as OS X Package Manager
by __david__ on Wednesday May 25, 2016 @05:21PM
(#11773222)
So you pull the package down and the signature checks out to some key on a pgp key server. How do you know it's the correct key?
[ Parent
| on HN ]
Generally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust.
With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.
> If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust.
No one has signed it, because the mythical web of trust does not exist. What now?