Hi, On 12/30/25 7:27 PM, Ali Polatel wrote:
> My initial goal is to switch signing Syd binary releases from gpg to > signify. Next intention is to consider signing package manifests on > Exherbo Linux distribution with it. If my memory serves me right, > Gentoo Linux and Portage has support for GPG signed manifests and > it has been a longstanding issue in Exherbo Linux how we want to > do manifests. Current consensus is to use thin package manifests > on a best-effort basis because we lack the developer time to go > all in. Thin manifests store a single checksum and package size > of the relevant package distfiles. My goal/dream is to integrate > signify into this workflow and start signing thin manifests using > signify. If the Exherbo Linux distribution lacks enough manpower to include checksums (which catch network errors, bitrot, and other forms of corruption) even though other distros (including Gentoo) simply require them and autocreate them, then I cannot help but wonder who is going to go one step further and also signify-sign the thin manifests that don't exist. For context, Gentoo / portage requires Manifests, but not that they be signed. git commit --gpg-sign is used as developer policy for the main repos, and release infrastructure verifies those signed commits and when exporting to an rsync tree, produces "GPG signed Manifests" (fat signed). Checksumming your software downloads is not something that does (or should?) require "developer time to go all in". It is basic error-correction so you can detect malformed files and redownload. Your tooling should simply do it for you. It is also of course security-relevant as it provides Trust On First Use. But it's not *only* for people who care about security. -- Eli Schwartz
OpenPGP_signature.asc
Description: OpenPGP digital signature
