Posts by Pol@mathstodon.xyz
 (DIR) Post #B4DFs4eBvCu61SRUoa by Pol@mathstodon.xyz
       0 likes, 0 repeats
       
       @solenepercent @solene Thanks for the article, I have a question though. Would it be the same if the base image would have been reproducible ? I guess you're verifying the signature simply because it is *not* reproducible right ? This way we have to blindly trust its author ?
       
 (DIR) Post #B4DebndLuKdnTcO1wm by Pol@mathstodon.xyz
       0 likes, 0 repeats
       
       @solene @solenepercent Yes, that's exactly the point I had in mind: signatures prove provenance, while reproducibility reduces the amount of trust I need to place in the producer.If I only verify a signature, I am still trusting the author and the build infrastructure. If the image is reproducible, then third parties can independently confirm that the published artifact matches the declared source and inputs.So to me these are complementary: signatures answer "who gave me this ?", while reproducibility helps answer "can this claim be verified independently ?".