4 ms·
All the npm cases I can think of have been in javascript code, not 'binaries'. So that wouldn't have prevented any of them.
by lacampbell 7y ago
All the npm cases I can think of have been in javascript code, not 'binaries'. So that wouldn't have prevented any of them.
- est31 7y agoFair point. For Javascript there is no binary step so it has to be in the source code. In compiled languages, this is different: you can hide it in the binary, and finding it there is much harder than checking the source code VCS history. So without reproducible builds, compiled package managers would be in an even worse situation than Javascript, at least what ability to review the uploaded packages is concerned. Ultimately the problem doesn't have a good solution right now. Reproducible builds are a part of the solution, as is making it harder for malicious debian packagers to upload infected binaries. You need to protect the entire supply chain.
- zzzcpan 7y agoIt makes absolutely no difference when binary packages are compiled on a trusted build farm, i.e. like everyone does already.