HNGlance

Top Best New Show

CII' FOSS best practices criteria

https://bestpractices.coreinfrastructure.org/en/criteria

by Seirdy • 5 years ago

2 1 5 years ago

BE

bestpractices.coreinfrastructure.org

Related Stories

Loading related stories...

Comments

1

dane-pgp• 5 years ago

It's good that having a reproducible build process is a requirement for the Gold rating, as is signed releases.

Perhaps there needs to be a Platinum level which involves storing the hash of each release in a distributed append-only log, with multiple third parties vouching that they can build the binary from the published source.

Obviously I'm thinking of something like sigstore[0] which the Arch Linux package ecosystem is being experimentally integrated with.[1] Then there's Crev for distributed code review.[2]

[0] https://docs.sigstore.dev/

[1] https://github.com/kpcyrd/pacman-bintrans

[2] https://github.com/crev-dev/crev

Source preview

bestpractices.coreinfrastructure.org

HNGlance

© 2024-2026 HN Glance. Story content belongs to its original sources.

Privacy
Terms