ubuntu-appstore-developers team mailing list archive

[Martin Albisetti <martin.albisetti@xxxxxxxxxxxxx>]

On Thu, Aug 8, 2013 at 9:55 AM, Colin Watson <cjwatson@xxxxxxxxxx> wrote:
>
> If we're having the store sign the binary, that's news to me.  It's
> would be possible, and it would basically amount to appending something
> to the file; but I thought that the store developers were maxed out on
> commitments already, and that we were going to be relying on transport
> security.

I'm now trying to remember where all this conversation happened, as it
was very clear in my head but clearly not too far beyond that.
The plan was to have the signature in the index metadata, not appended
to the file, so on download the client can verify it.


> I was considering this as an optional extra rather than something we'd
> be relying on for core functionality.

Yes, I think it's an optional thing for 13.10, but maybe we'll want to
make it a core functionality beyond that?


-- 
Martin