StarDreamer

What descent? There is no descent. They started at bedrock since the beginning. People should have seen it back then.

That still leaves two out of three questions unanswered. Most importantly the last one, which was addressed towards the original complaint.

1. If your assumption is that X509 is trash, does that mean you hold the same amount of distrust to TLS?
2. How do you propose the scaling of key management? Do you have a reasonable alternative to users blindly trusting every single key they come across?
3. Back to my original question: what prevents a VSCode extension from stealing a private signing key (as opposed to an API key) and causing the same issues described here?

And how would apt help in this particular case? A supply chain attack can happen with any particular package manager. In this case, the compromised package was detected and mitigated within 93 minutes, affecting a total of ~330 users. Which is a lot better than how a lot of distros handled the xz breach last year.

All reasonably secure package managers (and https) operate on a chain of trust. There is little that can be done if that chain of trust is broken.

Based on this the cause was a malicious VSCode extension that stole credentials that were later used to trigger a deployment CI/CD pipeline. If there’s anything to learn from this, it’s probably to not use VSCode.