News for hackers. Stuff that matters.

A comment on Making popular Ruby packages more secure. Parent comment

Re:Making popular Ruby packages more secure by jacques_chester on Monday June 13, 2022 @08:22PM (#31733346)
HTTPS only protects the transmission from repository to user. It doesn't protect the package in the repository.
[ Parent | on HN ]
Re:Making popular Ruby packages more secure by klysm on Monday June 13, 2022 @10:26PM (#31734113)
Yeah but what trust system are you going to use for that? I don’t see how anything at scale buys you too much
[ Parent | on HN ]
Re:Making popular Ruby packages more secure by pabs3 on Saturday June 18, 2022 @08:00AM (#31789093)
The Linux distros use OpenPGP/X.509 keys stored on HSMs for their archive security, and a set of per-maintainer keys that are used to verify changes to the archive. RubyGems/Cargo/etc could use something like that.
[ Parent | on HN ]