3 ms·
They missed the bit about verifying the validity of the content of the tarball... Given that you're essentially guarding against GitHub going rogue, that's half
by rickycook 11y ago
They missed the bit about verifying the validity of the content of the tarball... Given that you're essentially guarding against GitHub going rogue, that's half the point right?
- creshal 11y agoVerifying the content is one thing, what about making sure the archive itself isn't malicious and triggering tar/gzip/zip vulnerabilities? In my experience, github's archives are not generated in a reproducible way.
- creshal 11y agoNever mind that comment, as established in a different comment chain, it's an inherent limitation of zip archives. .tar.gz archives are fully reproducible.
- ashitlerferad 11y agogithub archives are definitely generated in a reproducible way.
- LukeShu 11y agoThey are now. They weren't 2 or 3 years ago.