Conversation

Replying to

and

There are language package managers with package signing. At the very least, pinning the key fingerprint on first use with a mechanism for automatically rotating to requiring signatures from additional new keys works well.

Replying to

and

I'm not sure that end-user key management actually does work well for a system that operates at the scale that NPM does. Do you know what the largest deployment of such a package manager is?

Replying to

and

I don't understand what scale has to do with it. Package signing works fine for many other package managers with a large scale. The basic trust on first use security properties don't require any end user key management or extra work on their part.

This Tweet was deleted by the Tweet author. Learn more

Tony "Abolish ICE" Arcieri

Replying to

and

I too have direct experience working on many package managers specifically on the problem of package signing, and I would argue for a signing system to be useful, at a minimum every package needs to be signed by a key which is ultimately trusted by the end user

Tony "Abolish ICE" Arcieri

Replying to

and

...but then there’s this problem to consider: how to handle key rotation

tonyarcieri.com

Key rotation, user experience, and crypto reporting

WhatsApp was the subject of a recent Guardian article making claims of a “backdoor” stemming from a “bug” in the way WhatsApp handles key rotations for users. The problem? WhatsApp will automatically...

Replying to

and

For package signing, automatic rotation based on the old key signing a off on the rotation to a new key works well. Here's an example: source.android.com/security/apksi I don't understand making this out to be so hard when package signing is used at huge scales surprisingly successfully.