Hacker News new | past | comments | ask | show | jobs | submit login
Ask HN: Keyrings: per-package/repo; commit, merge, and release keyrings?
1 point by westurner on Feb 18, 2021 | hide | past | favorite | 1 comment
Are there existing specs for specifying per-package release keyrings and per-repo commit and merge keyrings?

Keyring: a collection of keys imported into a datastore with review.

DevOpsSec; Software Supply Chain Security




Packages {X, Y, Z} in Indexes {A, B, C} are artifacts that are output from Builds (on workstations or servers with security policies) which build a build script (which is often deliberately not specified with a complete programming language in order to minimize build complexity; instead preferring YAML) which should be drawn from a stable commit hash in a Repository (which may be a copy of technically zero or more branches of a Repository hosted centrally next to Issues and Build logs and Build artifact Signing Keys).

Maxmimally, are there potentially more keyrings (or key authorization mappings between key and permission) than (1) commit; (2) merge; and (3) release?

Source Projects: Commit, Merge, [Run Build, Login to post-build env], Release (and Sign) package

Downstream Distros: Commit, Merge, [Run Build, Login to post-build env], Release (and Sign) package for the {testing, stable, security} (Signed) Index catalogs




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: