3 ms·
CI has always been a Yellow Smiley Face Post-it, and the only thing I can true see to combat this is reproducible builds - just like if your repo was compromise
by alfiedotwtf 6y ago
CI has always been a Yellow Smiley Face Post-it, and the only thing I can true see to combat this is reproducible builds - just like if your repo was compromised, a dev is going to notice pretty fast if their local build differs from a compromised CI build
- watermelon0 6y agoWould they really notice? You can have reproducible builds, but unless someone explicitly checks checksums of local builds, it won't be noticed.