I think we should have a top level category around integrity verification that is separate from package signing.
For example npm supports sub resource integrity with SHA-512 hashes for newly published packages and has the ability to increase the strength of that hash in the future.
I propose something like this.
Integrity verification
Package manager provides a method for verifying the integrity of the downloaded package.
None - no integrity verification is done
Partial - integrity verification is done using a weak*
Yes - Verification is done using a sufficiently secure method
* we would want to define this.
Happy to PR this but figured discussion was desired first.
I think we should have a top level category around integrity verification that is separate from package signing.
For example npm supports sub resource integrity with SHA-512 hashes for newly published packages and has the ability to increase the strength of that hash in the future.
I propose something like this.
Integrity verification
Package manager provides a method for verifying the integrity of the downloaded package.
*
we would want to define this.Happy to PR this but figured discussion was desired first.