5 ms·
> anyone who isn't fetching their packages through Google's proxy will get told that whatever they're using is trying to trick them. No, the error message you
by morelisp 4y ago
> anyone who isn't fetching their packages through Google's proxy will get told that whatever they're using is trying to trick them.
No, the error message you get is neutral about which side might be wrong - it says "verifying module: checksum mismatch" and "This download does NOT match the one reported by the checksum server." (I've seen it a lot because it also appears when module authors rebase, which a small but surprisingly high number do...)
- lanstin 4y agoWow, that is shocking. There is never a reason to rebase a public git repo, except maybe credentials leak in the past.
- adityasaky 4y agoEven then, you want to revoke those credentials rather than try to wipe it from history, no?
- lanstin 4y agoThat is what I think but security people want both.
- adityasaky 4y agoStrange, I hadn't come across that before. Not sure what they're trying to achieve, deny they ever had a leak?
- lanstin 4y agoThird party security consultants, following a check list.