Checksums/signatures

[taq]

Hey, thanks for your work!

As now Mise use the precompiled Ruby packages, I think it could be a good idea to create file checksums or even sign the files with a PGP key. Then Mise can check if the precompiled file matches with the checksum/signature.

What do you think?

[jdx]

GitHub already publishes SHA-256 digests for release assets, and these binaries have GitHub/SLSA attestations that anyone can verify with gh attestation verify. I don’t think maintaining separate checksum files or a PGP signing key would add enough value to justify the extra machinery.

AI-assisted — Tool: Codex; model: OpenAI/unavailable; version: unavailable.

[taq]

You're right that a checksum file or PGP signature wouldn't add anything on the integrity axis, the SLSA attestation already proves the asset wasn't tampered with after the build, and gh attestation verify covers that well. That's not really what I'm after.

My real concern is the trust root, not really integrity. The SLSA attestation is entirely anchored in GitHub: GitHub OIDC identity, Fulcio, the whole verification path lives inside the same platform the build runs on.

So it collapses "I trust GitHub" and "I trust the maintainer" into one thing. A maintainer key that lives outside GitHub, ideally offline, separates those: compromising the GitHub account/CI alone wouldn't be enough to forge a valid signature, you'd need the private key, which isn't there. That's the model most Linux distros rely on, and it's meaningful for anyone who doesn't want to take GitHub as a mandatory root of trust (packagers, regulated environments, etc.).

I'll grant the cost objection is real, and I'd add a caveat to my own ask: a key only delivers this if it's offline and disciplined about rotation/revocation/distribution. A signing key kept as a CI secret buys almost nothing over the attestation, same attack surface. So this only makes sense as an offline-key setup, which I understand is real maintenance burden.

Not asking you to take it on, just wanted to be clear the value isn't redundant integrity, it's an independent trust root. As an oldtimer I'm always kind of worried with this kind of stuff. 🙂

[jdx]

the builds happen inside github ci and are automated so I'm not sure what you're asking me to do exactly. I know not everyone has the same opinion on this but I don't believe it's a smart idea to ship binaries from development machines anymore.

[taq]

That's a fair point, an offline signing key would mean signing on a human machine, which reintroduces exactly the workstation-compromise risk your automated CI avoids. I hadn't weighed that trade-off properly.

My underlying wish was a trust root independent of GitHub, distro-style, but I'll admit that's hard to achieve without giving up the automation you get here (OK, sometimes I'm a paranoid dreamer!) and the SLSA attestation is honestly a stronger origin guarantee than upstream Ruby source itself ships (which is checksums only). Fair enough, thanks for engaging!