4 ms·
> Auditable Build Process > Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step
by vdfs 6y ago
> Auditable Build Process
> Builds are produced by GitHub Actions with an auditable build and release generation process. Each build has a "Document SHAs" step, which will output SHA checksums for the build produced by the GitHub Action, so you can verify that the source code for a given build corresponds to any given release
What will stop an attacker from hard coding code source file hashes? I'm not saying they will, just that it's a bad method of making binaries auditable
- gruez 6y agoNothing. The point is that you can replicate the same steps on your local machine and the hashes should be the same. If they're not it means either github actions and/or the repo owner has been compromised.