Replying to Avatar franzap

Definitely agree that attestations can't be placed on mutable events.

> What if the author accidentally included a binary from the previous release? the hashed file would still have trust attestations attached.

Doesn't this go against your point? If the author accidentally points to a wrong binary in a mutable release set event, they can update it.

A user cares about finding an attestation for the actual thing they're installing.
Avatar
DanConwayDev 1y ago

If it were mutable, the author would need to revoked and reissue which would notify the users who installed the incorrect version.

I'm coming around to mutable. You wouldn't want to have to revoke a release to fix a typo in the change log. Clients could also keep track of the version they installed from and notify the user if a new version comes in with worrying changes in it.

Reply to this note

Please Login to reply.

Discussion

Avatar
franzap 1y ago

Right, I'm thinking clients could detect an update in the mutable release set, and then trigger double-checking the references file metadatas? As you say maybe it's just a typo and user needn't be prompted about it