On Mon, 25 May 2026, Dick Brooks via curl-users wrote:
https://daniel.haxx.se/blog/2026/03/26/dont-trust-verify/
I believe there may be a more efficient way to verify trust in curl, without
needing to download or install any software, by using a "Public Trust
Infrastructure" (PTI) Trust Registry, as shown in this trust verification
lookup.
You cannot verify the contents without having it downloaded where the
verification is done. The point with that check is to detect if I have gone
rogue (and planted something in the tarball) or if my dev-tools have been
tampered with and inserts bad stuff somewhere that ends up in the curl release
etc.
I sign the releases so you can use my key to verify that the release was done
by me, but to know that the tarball only contains data that originates from
git contents and proper autotools etc, you need to check reproducibility.
--
/ daniel.haxx.se || https://rock-solid.curl.dev
--
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette: https://curl.se/mail/etiquette.html
