Re:Signing .jars is not worth the effort
by chrisseaton on Sunday July 26, 2020 @02:32PM
(#23959079)
Isn't the idea that you form your own trust network? For example meeting people in-person at conferences and signing each other's keys, and extending trust that way?
[ Parent
| on HN ]
Re:Signing .jars is not worth the effort
by CamouflagedKiwi on Sunday July 26, 2020 @04:35PM
(#23959990)
Conceptually you could do that, if you were willing to only use dependencies from people you trusted that closely. That can only be a very, very tiny minority of people using Maven.
Re:Signing .jars is not worth the effort
by chrisseaton on Sunday July 26, 2020 @06:20PM
(#23960618)
> if you were willing to only use dependencies from people you trusted that closely
No that's what makes it a network. There's a transitive closure, so you can also use dependencies from someone trusted by someone you trust, or by someone trusted by someone trusted by someone you trust, and so on.