fosres@posteo.de writes: > Hello All, > > In an earlier post I asked why Debian uses PGP to sign packages > despite its complexity. > > Some responded that Sequoia PGP simplifies the process. > > I now wish to ask why Debian uses PGP in general to sign packages when > there are alternatives such as SigStore. > > What were the unique benefits in PGP that could not be found in other > alternatives? It existed. Sigstore or other alternatives didn't, at the time. Sigstore and other transparency logs like Sigsum offers better security claims than PGP ever has, protecting against hidden releases. I wish there were pure C and Python verifiers available for Sigstore and Sigsum to further ease of use of these technologies. /Simon
Attachment:
signature.asc
Description: PGP signature