Hacker News new | ask | show | jobs
by lorecore 43 days ago
Signed commits could solve this in a more decentralized way if people post their public keys on their own domains.
1 comments
skydhash 43 days ago
Own domains is the real deal. My preffered model is tarball releases with checksums, or better yet, with signatures (like remind[0] or msmtp[1]). Such pages are trivial to host properly and loads quickly.

[0]: https://dianne.skoll.ca/projects/remind/

[1]: https://marlam.de/msmtp/download/

link
account42 38 days ago
I was confused for a bit what those two projects have to do with signatures but I guess you are just using them as examples of having (PGP) signatures for downloads?
link