Comment Comment by raesene4 A big problem with Software repositories that don't allow for /enforce cryptographic signing by the developer is that this can happen...Ideally the developer would sign before publishing and the consumer could check the signature to validate before using.Whilst not a silver bullet this is a kind of essential part of a secure package management solution. parent raesene4 10 years ago
Ideally the developer would sign before publishing and the consumer could check the signature to validate before using.
Whilst not a silver bullet this is a kind of essential part of a secure package management solution.