kpcyrd/pacman-bintrans
View on GitHub ↗ ★ 85 Rust
Experimental pacman integration for Reproducible Builds and Binary Transparency (with sigstore/rekor)
16 mentions on Hacker News by 6 people: 4 stories, 12 comments · first 2021-08-23 · latest 2022-11-01
20082026
-
No, not compile time... just verifying binary transparency: https://github.com/kpcyrd/pacman-bintrans
comment by encryptluks2 · 2022-11-01 · in Is my package reproducible yet? -
…that I trust". What that looks like in practice is probably some mixture of the following projects: https://github.com/kpcyrd/pacman-bintrans https://users.rust-lang.org/t/rust-code-reviews-web-site-for...…
comment by dane-pgp · 2022-02-15 · in ProtonMail Is Inherently Insecure, Your Emails Are Likely Compromised (2021) -
…on sigstore and (optionally) checks each package for being reproducible before installation. https://github.com/kpcyrd/pacman-bintrans https://www.sigstore.dev/ I think this is generally useful for a lot of ecosystems indeed, and it's cool…
comment by Foxboron · 2022-01-24 · in Solving Open Source Supply Chain Security for the PHP Ecosystem -
…audits, and how to fund that auditing work, but it greatly mitigates other classes of attack. [0] https://github.com/kpcyrd/pacman-bintrans [1] https://github.com/crev-dev/cargo-crev
comment by dane-pgp · 2021-11-20 · in I Love Arch, but GNU Guix Is My New Distro -
…with.[1] Then there's Crev for distributed code review.[2] [0] https://docs.sigstore.dev/ [1] https://github.com/kpcyrd/pacman-bintrans [2] https://github.com/crev-dev/crev
comment by dane-pgp · 2021-10-29 · in CII' FOSS best practices criteria -
…to enable Binary Transparency, and they're already being used in the Arch Linux package ecosystem: https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-10-05 · in A new public beta of GitHub Releases -
You'll probably enjoy how it is being used to secure the Arch Linux package ecosystem then: https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-10-01 · in The Secure Open Source Pilot Program -
…certificates, for example. [0] https://security.googleblog.com/2021/03/introducing-sigstore... [1] https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-09-19 · in Crev is a code review system -
…[1] https://github.com/tasn/webext-signed-pages/issues/13 [2] https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-09-06 · in Clarifications regarding arrest of climate activist -
…Ideally these third-party mirrors would also support binary transparency, using a system like this: https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-09-03 · in “apkeep,” EFF's new APK Downloader -
…would need to avoid updating the app until an audit by a trusted third party had approved it. [0] https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-08-29 · in Show HN: We built an end-to-end encrypted alternative to Google Photos -
…to be Binary Transparency, with the adoption of the sort of approach being trialled by Arch Linux: https://github.com/kpcyrd/pacman-bintrans
comment by dane-pgp · 2021-08-26 · in Thousands of Debian packages updated from their upstream Git repository