MavenGate gets it all wrong and hurts open source

#1

Post by erikvanoosten » Sun, Aug 25, 2024, 11:26 AM UTC

MavenGate gets it all wrong and hurts open source
day-to-day-stuff.blogspot.com

Re: MavenGate gets it all wrong and hurts open source

#2

Post by gavinhoward » Sun, Aug 25, 2024, 1:02 PM UTC

This security theater around supply chain security is getting ridiculous.

What we need is true supply chain security, but no one is willing to pay for that; it would mean paying FOSS projects, and companies don't want to pay for their "free" software.

Re: MavenGate gets it all wrong and hurts open source

#3

Post by rho138 » Sun, Aug 25, 2024, 1:25 PM UTC

gavinhoward wrote: post #2

This security theater around supply chain security is getting ridiculous. What we need is true supply chain security, but no one is willing to pay for that; it would mean paying FOSS projects, and companies don't want to pay for their "free" software.

I just want an actual bill of versioned open source software used in each closed source app.

Re: MavenGate gets it all wrong and hurts open source

#4

Post by rho138 » Sun, Aug 25, 2024, 1:29 PM UTC

Are packages cryptographically signed by the actual package maintainer or only with the repo owners key?

Re: MavenGate gets it all wrong and hurts open source

#5

Post by erikvanoosten » Sun, Aug 25, 2024, 2:04 PM UTC

rho138 wrote: post #4

Are packages cryptographically signed by the actual package maintainer or only with the repo owners key?

As package maintainer you are required to sign the packages with a PGP key. Maven Central also requires that you upload that PGP key (the public part only of course) to one of a few well-known key servers.