1368 2019-04-03 05:39:04 +0200 Source Certification Contract (SCC) 2019-04-03 05:54:50 +0200 1 1 3 JogAmp General builds tbd All all IN_PROGRESS P4 normal --- 1369 1 sgothel sgothel FEATURE --- oldest_to_newest 6188 0 sgothel 2019-04-03 05:39:04 +0200 Long term goal implementing SCC as an secure trustworthy alternative to simply signed jar files. https://jogamp.org/wiki/index.php/SCC_Overview Are You Who You Say You Are? This question doesn't make clear Who is who, or who are we talking about? When attempting to run a binary object on your system, users need to trust the binary and its original source code. The question should ask for the authorship of the binary and it's assumed source code, hence SCC authenticates the binary against the source code it claims to be originated from. SCC answers: This binary is produced by this set of source code, which is trusted by these people. SCC verifies whether a binary object's signature matches its assumed source code signatures. SCC provides a list of personal signatures who trust this source code, as well as a list of personal signatures who trust this binary object. Hence SCC incorporates a chain of trust. https://en.wikipedia.org/wiki/Chain_of_trust