HN user

0xmason

2 karma
Posts1
Comments3
View on HN

Have orgs done this manually in the past? For example, they have a private key that is stored in Github secrets and it signs the artifact upon action completion and posts it to some tamperproof registry.

Then anyone can verify it by checking the signature and contents against the org's public key, which is made available somewhere.

This certainly seems like a UX improvement, and a simpler (and thus safer) key management process.