← Back to context

Comment by mbreese

5 days ago

Cryptography/security is a trust business. Without some kind of personal (or even project) history, I know nothing about you or the project. And if I can’t verify you, I can’t trust you. The rest doesn’t matter much to me.

But maybe that’s just me.

7 comments

mbreese

Reply
stasher-dev  5 days ago

I get it. An 'anonymous' author is a deal breaker for some. I respect that.

The repo is public. The releases are signed. The attestations are published. Nothing hidden.

If that’s not enough — totally fair and I am sure many others would agree. Appreciate your point of view and taking time to give feedback.

  • i_am_proteus  5 days ago

    Would you please elaborate on how "the releases are signed" helps establish trust in the context of your anonymous developer account?

    • stasher-dev  5 days ago

      It means the releases are cryptographically signed using GitHub OIDC, with SLSA v1 provenance and entries in the Rekor transparency log.

      That means:You can verify every artifact against its source code i.e I have not tampered with the code post deployment. for example part of the build is a dry-run on the worker build, this is stored as part of the build so you can see / confirm the exact code that was uploaded and this code is signed.

      2 replies →