A signature the platform can't forge
A checksum proves the bytes match the manifest, but says nothing about who wrote the manifest. Why self-update needs a signature instead.
Categories
13 pages
Security
Anything under an 8
The national vulnerability database is buckling under defunding and volume, which changes what a severity score is actually worth.
Nobody's coming to clean your supply chain
Signed but poisoned packages show a signature proves who sent something, not what is in it. Nobody is coming to clean this up for you.
