New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

How to Improve Package Verification #5

Open

dave2wave opened this issue Feb 1, 2025 · 0 comments

Member

dave2wave commented Feb 1, 2025

Packages are validated/verified in the following ways:

Check that the detached signature matches the public signing key.
Check that the SHA512(or others) matches the package.
Optional check a signed binaries digital certificate issued on demand.

We have some issues to consider:

The Web of Trust is not dependable.
We can leak signed release candidates.
Most users don't verify completely.

We need to discuss how we can make verification easy for any downstream consumer of ASF software.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment