News for hackers. Stuff that matters.

A comment on Sigstore protects Apt archives: apt-verify and apt-sigstore. Parent comment

Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by a_vanderbilt on Monday April 17, 2023 @11:22PM (#35609598)
Re-read my initial reply to the thread. It is stated.
[ Parent | on HN ]
Re:Sigstore protects Apt archives: apt-verify and apt-sigstore by bombolo on Tuesday April 18, 2023 @01:42AM (#35610364)
gpg can be used to sign a single file, if for any reason you download a single .deb instead of using a repository.

If your supplier doesn't sign them… take it with them?

[ Parent | on HN ]