[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87ms2y1d2m.fsf@gmail.com>
Date: Wed, 31 Dec 2025 14:49:53 -0800
From: Collin Funk <collin.funk1@...il.com>
To: Simon Josefsson <simon@...efsson.org>
Cc: kf503bla@...k.com, oss-security@...ts.openwall.com
Subject: Re: Re: Best practices for signature verifcation
Hi Simon,
Simon Josefsson <simon@...efsson.org> writes:
> 6) Sigstore and Sigsum. (I hope I provoke both camps here too :)) These
> are modern designs that realize that signatures without transparency is
> not effective against practical attacks. Reasonable well specified,
> although lacking in multiple implementations and PQ options. Sigstore
> suffer from complexity and its focus on container security. Sigsum
> suffer from lack of non-Go implementations and MIME integration.
Doesn't Sigstore require a centralized Rekor instance? That was the
impression I based on a very brief look at it previously.
Collin
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
