Re: curl verification

On Mon, 25 May 2026, Dick Brooks via curl-users wrote:

> https://daniel.haxx.se/blog/2026/03/26/dont-trust-verify/
>
> I believe there may be a more efficient way to verify trust in curl, without 
> needing to download or install any software, by using a "Public Trust 
> Infrastructure" (PTI) Trust Registry, as shown in this trust verification 
> lookup.

You cannot verify the contents without having it downloaded where the 
verification is done. The point with that check is to detect if I have gone 
rogue (and planted something in the tarball) or if my dev-tools have been 
tampered with and inserts bad stuff somewhere that ends up in the curl release 
etc.

I sign the releases so you can use my key to verify that the release was done 
by me, but to know that the tarball only contains data that originates from 
git contents and proper autotools etc, you need to check reproducibility.

-- 

  / daniel.haxx.se || https://rock-solid.curl.dev
-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html