Re: Preventing supply chain attacks via rekor
Am 12.06.21 um 02:51 schrieb Kevin Fenzi:
> Also, not having it available has made it *very* hard to prioritize
> getting the issues fixed in DNF. So being able to improve this is
> predicated on the existence of signed metadata.
This seems odd to me. I mean, it can't be hard to setup a test repo, is
it? I suspect we could even ask QE folks to do some testing and map out
the issues they find. I don't think it's nice/ethical to break users
just as a means to make bugs we want to have fixed higher priority.
Anyhow, we are pretty off topic for this thread, so I'll try and stop...
kevin
Does it really hurt someone, if the repos get signed and clients just do
not check this by default?
Of course, the signing should not break the unchecked repo in any form,
which needs a small testcase ;)
Best regards,
Marius