Just-in-time packager for GitHub repositories • Hacker News Board

Re: Just-in-time packager for GitHub repositories

#31

Post by pron » Wed, Feb 11, 2015, 11:23 PM UTC

teacup50 wrote: post #30

jermo wrote: post #24

Earlier quoted context omitted.

Releases have to be PGP signed, snapshot's don't. How many people do you know that verify PGP signatures of their artifacts? Do you?

Yes, we verify signatures at our middleware repository cache.

Really? Impressive! Where do you get the public keys? Most projects hosted on Maven Central don't publish them on their website.

Re: Just-in-time packager for GitHub repositories

#32

Post by teacup50 » Thu, Feb 12, 2015, 4:00 PM UTC

pron wrote: post #31

teacup50 wrote: post #30

Earlier quoted context omitted.

Yes, we verify signatures at our middleware repository cache.

Really? Impressive! Where do you get the public keys? Most projects hosted on Maven Central don't publish them on their website.

http://blog.sonatype.com/2009/04/nexus-133-introduces-automa...

Re: Just-in-time packager for GitHub repositories

#33

Post by pron » Thu, Feb 12, 2015, 7:42 PM UTC

teacup50 wrote: post #32

pron wrote: post #31

Earlier quoted context omitted.

Really? Impressive! Where do you get the public keys? Most projects hosted on Maven Central don't publish them on their website.

http://blog.sonatype.com/2009/04/nexus-133-introduces-automa...

But unless the signers have a public certificate, or publish their public keys on their website (which you need to obtain manually), the signatures on Maven Central can be just as fake as the artifacts.