3 ms·
Distributions like Debian are way more strict than that: - peer reviews including licensing review - package signing - various types of build and integration
by goodpoint 5y ago
Distributions like Debian are way more strict than that:
- peer reviews including licensing review
- package signing
- various types of build and integration tests
- reproducible builds
- freeze periods
- build hardening flags and sandboxing
- strong identity verification with PGP web-of-trust
- mistrial9 5y agoI believe it is a combination of human social checks and math PGP, both .. that stand the test of time, since either one by itself can and will fail spectacularly, at exactly the wrong times
- aaaaaaaaata 5y agoWhich adds n days to their patch interval.
- Vogtinator 5y agoNot necessarily caused by those points, if at all a specific implementation.
- goodpoint 5y agoIf anything, it's the opposite. Distributions provide security patches that upstream often do not.