4 ms·
Just having references to the packages isn't enough, you also need the source code of the packages themselves.
by msla 4y ago
Just having references to the packages isn't enough, you also need the source code of the packages themselves.
- ChrisRackauckas 4y agoIt contains a reference to source code in the package server that is disconnected from the package author so it's retrievable in the event of a left-pad-like event. This is what's queried upon download in order to ensure that no funny business could lead to a security threat down the line either. It's kept on the package servers as an immutable source of truth referenced by the UUID and SHA.
- adgjlsfhk1 4y agothat all works. The package manager tracks source code for every version of every package.