3 ms·
Verifying the content is one thing, what about making sure the archive itself isn't malicious and triggering tar/gzip/zip vulnerabilities? In my experience, git
by creshal 11y ago
Verifying the content is one thing, what about making sure the archive itself isn't malicious and triggering tar/gzip/zip vulnerabilities? In my experience, github's archives are not generated in a reproducible way.
- creshal 11y agoNever mind that comment, as established in a different comment chain, it's an inherent limitation of zip archives. .tar.gz archives are fully reproducible.
- ashitlerferad 11y agogithub archives are definitely generated in a reproducible way.
- LukeShu 11y agoThey are now. They weren't 2 or 3 years ago.