News for hackers. Stuff that matters.

A comment on Secretive – macOS native app to store SSH keys in the Secure Enclave.

Re:Secretive – macOS native app to store SSH keys in the Sec... by vdfs on Saturday June 27, 2020 @05:38PM (#23664891)
> Auditable Build Process

> Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release

What will stop an attacker from hard coding code source file hashes? I'm not saying they will, just that it's a bad method of making binaries auditable

[ Parent | on HN ]
Re:Secretive – macOS native app to store SSH keys in the Sec... by gruez on Saturday June 27, 2020 @05:42PM (#23664909)
Nothing. The point is that you can replicate the same steps on your local machine and the hashes should be the same. If they're not it means either github actions and/or the repo owner has been compromised.
[ Parent | on HN ]