Re:Signing .jars is not worth the effort
by CamouflagedKiwi on Sunday July 26, 2020 @04:35PM
(#23959990)
Conceptually you could do that, if you were willing to only use dependencies from people you trusted that closely. That can only be a very, very tiny minority of people using Maven.
[ Parent
| on HN ]
Re:Signing .jars is not worth the effort
by chrisseaton on Sunday July 26, 2020 @06:20PM
(#23960618)
> if you were willing to only use dependencies from people you trusted that closely
No that's what makes it a network. There's a transitive closure, so you can also use dependencies from someone trusted by someone you trust, or by someone trusted by someone trusted by someone you trust, and so on.