cosign

One thing that the Go module system solves that seems to be unaddressed in CUE's design based on OCI is the sum database / transparency log. I could add a "Statement that we might wish to make for a module M" to the "Module contents assurance" section: - The content of module M is the same content that everyone else sees for the same `$path@$version`. Though I guess users can utilize existing solutions like https://github.com/sigstore/cosign or rekor (mentioned elsewhere itt).

Yes, see https://github.com/sigstore/cosign/blob/main/USAGE.md for one example

From the sigstore docs: https://docs.sigstore.dev/ : > sigstore empowers software developers to securely sign software artifacts such as release files, container images, binaries, bill of material manifests [SBOM] and more. Signing materials are then stored in a tamper-resistant public log. /? sigstore sbom: https://www.google.com/search?q=sigstore+sbom > It’s free to use for all developers and software providers, with sigstore’s code and operational tooling being 100% open source, and everything maintained and developed by the sigstore community. > How sigstore works: Using Fulcio, sigstore requests a certificate from our root Certificate Authority (CA). This checks you are who you say you are using OpenID Connect, which looks at your email address to prove you’re the author. Fulcio grants a time-stamped certificate, a way to say you’r

From what I've seen in a few minutes looking at Sigstore, it seems they require packages to be stored in a OCI-compliant store... which it differs on how package managers are storing packages. So it might be not as trivial. Or perhaps I'm missing something? https://github.com/sigstore/cosign

Thanks for the cosign mention! Maintainer here. The link is github.com/sigstore/cosign for anyone reading along!

Have a look at Sigstore and their tool cosign. It's aiming to be the Let's Encrypt of code signing. I'm not sure if arbitrary binaries are supported fully yet, but it's being worked on. https://github.com/sigstore/cosign

Using cosign/sigstore to sign release artifacts https://github.com/sigstore/cosign and instructions for validating signature on download could be a good option here.

We have a similar approach planned in sigstore, but with a slightly different approach to the timestamps by using Transparency Logs. We have some demos here on how to sign git commits: https://github.com/sigstore/cosign/blob/main/FUN.md The idea is that you can use short-lived keys, bound to certificates via an ACME-style challenge, but based on an email address. The signature goes into a Transparency log to prove it happened while the cert was valid. Then revocation is no longer an issue.

Depends what you mean by available :) It's all basically up and running right now in a "sandbox" where we make no promises on integrity or availability but, we're encouraging people to try it out and give feedback. If you want to try it out to sign containers this branch has everything you need: https://github.com/sigstore/cosign/pull/53