Post

Signature-based SRI is being spec'd right now: wicg.github.io/signature-ba... This will be useful for many use case and become relevant for PCIv4 compliance which requires assuring the integrity of sourced scripts (6.4.3). Please chime in and share your use cases: github.com/WICG/signatu...

Ben Stock

@benstock.bsky.social

18 Nov 2024

On the plus side, one of the limitations of SRI was third parties adding random content (see swag.cispa.saarland/papers/steff... final table). However, SRI in its current form protects including sites from a full compromise, whereas this assumption is being relaxed if there are signatures involved.

swag.cispa.saarlandswag.cispa.saarland

Lukas Weichselbaum

@webappsec.dev

Indeed signatures have different security properties, but since trusting a signature is an opt-in feature, I'm not worried about this.

18/11/24, 8:41 pm0 reposts0 likes

Lukas Weichselbaum

@webappsec.dev

18 Nov 2024

Also Signatures allows for nice advanced code provenance use cases like removing the CDN form the TCB by signing an OSS build in a github workflow and have the CDN pass on the pubkey.