Sigstore protects Apt archives: apt-verify and apt-sigstore

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by exabrial on Sunday April 16, 2023 @11:52AM (#35591108)

Go ahead and prep your downvote, but please stop re-inventing pgp. _loud sigh_.

There’s something to be said to have the same pgp key sign a contributor license agreement, that pgp key signs the commits, that pgp signs the release artifacts, same key with an ssh subkey accesses build servers. Using key base we can see what keys control related Social media and emails.

Honestly the _only_ thing missing of an immutable chain for releases hashes.

Now get off my lawn.

[ Parent | on HN ]

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by klysm on Sunday April 16, 2023 @11:56AM (#35591162)

I don’t see how pgp and sigstore are equivalent

[ Parent | on HN ]

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by dlor on Sunday April 16, 2023 @12:10PM (#35591289)

They have similarities in that they both can be used to sign things, but the architecture is completely different and sigstore is designed for different tradeoff - namely to be much easier to get started with and use.

[ Parent | on HN ]

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Sunday April 16, 2023 @06:09PM (#35594720)

sigstore is trying to replace pgp signing adding cloud?

[ Parent | on HN ]