Introducing OSS Rebuild: Open Source, Rebuilt to Last

[anonymous372]

Is this an alternative to Sigstore, or could these tools be used to supplement it?

Sigstore centralization concerns

Soatok made an article saying that the best replacement of PGP for signing software is Sigstore, but Kicksecure made an article saying that Sigstore is one of the worst options for signing software due to potential issues with centralization and required trust in entities like Google and Microsoft. It’s well known that Kicksecure values software freedom more than security, but are these freedom concerns bad enough that they outweigh the security benefits? You can apparently deploy Sigstore loca…