How Signed Updates Work - PattonWebz  🔗 **Source:** [How Signed Updates Work - PattonWebz](https://www.pattonwebz.com/security/how-signed-updates-work/) ## Highlights - The trust no longer lives in the store. It lives in the build system, at the moment the zip is signed. - Note: 📚 Signing moves trust from store to build system · - Main Content, "The three parts of a signed update" section - Core reframe of the whole article — every downstream mechanism (keys, Rekor, ratchet) exists to support this one claim · #atom/literature/h1 - A signature nobody logged, or a sudden new signature that shows up out of step with the real release history, is detectable. - Note: 📚 Public log detects, doesn't prevent, stolen-key signing · - Main Content, "The keys" section - Important nuance: Rekor-style logging is a detection control, not a prevention control — easy to conflate the two · #atom/literature/h2 - The software remembers the highest version it's ever verified and installed, and refuses to accept anything older than that. Even if that older version is validly signed. - Note: 📚 Ratchet blocks downgrade to old signed vulnerable version · - Main Content, "Verifying — and the ratchet" section - Answers a question a reader would likely have right after learning signatures alone are checked: "couldn't I just replay an old signed file?" · #atom/literature/h3 - Security controls narrow trust, they don't eliminate it - Note: [[Supply-chain-security]] — because extends the general principle that trust anchors should sit as close to creation as possible · - [[Supply-chain-security]] — because extends the general principle that trust anchors should sit as close to creation as possible · #atom/zettel/z1 - Check whether GravityKit's signed-update implementation actually publishes to a Rekor-style log today, or whether that's the article's forward-looking recommendation rather than current practice — https://www.pattonwebz.com/security/how-signed-updates-work/ #xref - Note: ✏️ Fleeting capture #atom/fleeting/f1 - Article idea: survey other premium WordPress plugin shops (Easy Digital Downloads-based sellers, etc.) for signed-update adoption and compare approaches #articleseed - Note: ✏️ Fleeting capture #atom/fleeting/f2