Signing

[max-mapper]

In addition to #157 it'd be cool to have signing built in to prebuild, maybe using the format from https://jedisct1.github.io/minisign/

[mafintosh]

Using bundled prebuilds this becomes npm's problem as we don't need to download / checksum anything. npm does that for us

[max-mapper]

I don't think signing is on npms roadmap. Checksumming might be, but not signing. Context node-forward/discussions#29

[mafintosh]

npm already does checksumming when installing. i don't think we'd gain anything by signing if npm doesn't do it, unless i'm mistaken what you mean.

[max-mapper]

• Signing meaning "prove this was published by a keyholder"
• Checksumming meaning "prove this file was not tampered with during the download"

[mafintosh]

I mean: with the prebuilds bundled inside the npm tarball I don't see what we gain by signing the binaries. It's still gonna execute JS code downloaded from npm that isn't signed.

[max-mapper]

good call. i guess if npm doesnt support signing we're screwed