We should set up a GPG keyring of trusted partner repos and have a flow which (similar/identical to the runtime import flow) can import apps and re-sign them. Thinking of large trusted entities who already do their own binary builds & CI, like the Document Foundation and Mozilla - so we don't need to rebuild the binaries.
We should set up a GPG keyring of trusted partner repos and have a flow which (similar/identical to the runtime import flow) can import apps and re-sign them. Thinking of large trusted entities who already do their own binary builds & CI, like the Document Foundation and Mozilla - so we don't need to rebuild the binaries.