4 ms·
I’ve watched PRs for packages and they do seem to get a decent amount of scrutiny. I’ve never had issues with any nix package.
by hamandcheese 4y ago
I’ve watched PRs for packages and they do seem to get a decent amount of scrutiny. I’ve never had issues with any nix package.
- lrvick 4y agoCommits are not signed and approvers do not sign anything either. Nothing stops a malicious Github employee, bribed maintainer, or someone who simply phished Github credentials from making a fake PR as someone else then approving it themselves or serving manipulated git history only to CI/CD systems. Major supply chain attacks like this have happened in lots of other package managers and most OS package managers at least learned their lesson and signs everything. Most package managers are blindly used in multi billion dollar applications, so they are a huge target for attack. * Gentoo: https://archives.gentoo.org/gentoo-announce/message/dc23d48d2258e1ed91599a8091167002 https://archives.gentoo.org/gentoo-announce/message/dc23d48d... * Debian: https://lists.debian.org/debian-devel-announce/2006/07/msg00003.html https://lists.debian.org/debian-devel-announce/2006/07/msg00... * NPM: https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes https://eslint.org/blog/2018/07/postmortem-for-malicious-pac... * PyPi: https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_sshdecorator_package/ https://www.reddit.com/r/Python/comments/8hvzja/backdoor_in_... * Ubuntu Snap: https://github.com/canonical-websites/snapcraft.io/issues/651 https://github.com/canonical-websites/snapcraft.io/issues/65... * Arch Linux AUR: https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html https://lists.archlinux.org/pipermail/aur-general/2018-July/...