1,177 karma · joined January 25, 2010
Open source multisig signoff solution: https://asfaload.com
- multisig approach: you can require multiple signers to sign a release for it to be accepted by downloaders. Protects against account compromise. Sigstore relies on OIDC, but this makes it often reliant on megacorps (and harder to self host, see next point)
- very easy to self host. You can deploy it internally without any problem, eg in an airgapped environment where you want to distribute signed artifact. This is impossible with Sigstore.
- accountless: the key is the identity. The multisig approach diminishes the problems that long-lived keys might bring. And you don't rely on an external OIDC provider to be able to sign.
- Air-gapped signers: it is possible to have air-gapped signers, as signing does not rely on an online service to verify an identity.
- easy for downloader: the use only has to provide the download url, and this is sufficient to authenticate the download.
- easy to audit: the backend data is stored in a git, that will be mirrored in different places, and anyone can mirror it for themselves.
You might agree or not with these choices, but there are enough differences to say that it doesn't reinvent the wheel, it's providing another approach which I think has its advantages.
https://ocsigen.org/ in Ocaml too
https://websharper.com/ for fsharp and csharp. Really good when I used in in fsharp
Maybe https://melange.re/v7.0.1/ too? (Not sure)
Asfaload is easy to selfhost, if it is of any interest to you.
Sources at https://github.com/asfaload/asfaload
Edit: global passes let you travel everyday of your pass, with passes of up to 3 months: https://www.interrail.com/en/interrail-passes/global-pass
It was a really good experience, so I'll continue that way.
If you want to check out the videos: https://www.asfaload.com/videos/