3 ms·
I don't get how this could happen. Why would anyone trust their build server to package the release tarball? Were they ever signed and checked by the devs? The
by moviuro 7y ago
I don't get how this could happen. Why would anyone trust their build server to package the release tarball? Were they ever signed and checked by the devs?
The way I understand releases and tarballs, I'd do it like this:
- git on my machine (supposedly safe)
- bundle the source code, sign it however necessary
- upload and publish the tarball + signature & checksums
That way, unless my own machine was compromised, it should be OK.
- johannes1234321 7y agoThe typical reason is that one has a build chain which predates docker and those things, where it wasn't guaranteed that doing it on different machines yields the same result, but having a master host gives consistent result, independent from who does it. In modern times the reason is that the release is produced in a CI pipeline. So once a build is green and matches allmothe rreleas criteria that tested build is released. In both cases using a git checkout for longer time is not a got idea and builds should be done as exports into clean directories.