conex-nocryptoversion

Establish trust in community repositories

Conex is a utility for verify and attest release integrity and authenticity of community repositories through the use of cryptographic signatures (RSA-PSS-SHA256). It is based on the update framework, especially on their CCS 2010 paper, and adapted to the requirements of the opam repository.

The developer sign their release checksums and build instructions. A quorum (with a configurable threshold) of repository maintainers signs the package name to developer key relation. These repository maintainers are enrolled by a quorum of offline root keys.

The TUF spec has a good overview of attacks and threat model, both of which are shared by conex.

AuthorHannes Mehnert <hannes@mehnert.org>
LicenseBSD-2-Clause
Published
Homepagehttps://github.com/hannesm/conex
Issue Trackerhttps://github.com/hannesm/conex/issues
MaintainerHannes Mehnert <hannes@mehnert.org>
Dependencies
Source [http] https://github.com/hannesm/conex/releases/download/0.10.1/conex-0.10.1.tbz
sha256=8e92a9fce2133fa44f7d81211790e911a1e011a138ca56da48af50d612ed4b81
md5=1e09e8e28c4b26d5a22b3a5afd1fdc5c
Edithttps://github.com/ocaml/opam-repository/tree/master/packages/conex-nocrypto/conex-nocrypto.0.10.1/opam
No package is dependent