You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Looking at the Snapcraft.yaml file, it doesn't look like there's any verification going on here for the fetched .deb file. For a security-focused application (or really any application) I think it would be a good idea if we verify the deb package as it gets pulled into the Snap build.
Does it make sense to include a gpg --verify step in the override-build: section?
Hi - this isn't really relevant anymore, since we're building the application from source, so you're able to check exactly what's being built. Closing for now, thank you!
Looking at the
Snapcraft.yaml
file, it doesn't look like there's any verification going on here for the fetched.deb
file. For a security-focused application (or really any application) I think it would be a good idea if we verify the deb package as it gets pulled into the Snap build.Does it make sense to include a
gpg --verify
step in theoverride-build:
section?Signing keys: https://updates.signal.org/desktop/apt/keys.asc
The text was updated successfully, but these errors were encountered: