Skip to content

GPG

1 page

  • Verifying Open Source Packages: From Checksums to GPG Signatures

    By Dongping Guo In Blog 727 words 4 min

    Dongping GuoSecurityGPGSecurityDevOps

    Verifying Open Source Packages: From Checksums to GPG Signatures

    When downloading binaries or source archives from open source projects, the common practice is to “check the hash.” While this ensures the file wasn’t corrupted during transit, it does nothing to prove the file was actually produced by the legitimate …

    When downloading binaries or source archives from open source projects, the common practice is to “check the hash.” While this ensures the file wasn’t corrupted during transit, it does nothing to prove the file was actually produced by the legitimate …