3 ms·
That norm still exists, and it's offered by Github in form of Github Releases feature as well. It's the downstream tooling ( i.e. all the builds and package ma
by reindeerer 4y ago
That norm still exists, and it's offered by Github in form of Github Releases feature as well.
It's the downstream tooling ( i.e. all the builds and package managers ) that need to clean their act up.
- JonChesterfield 4y agoIf the source tar changes, how do you propose the downstream tooling distinguishes between data corruption, MITM attack and upstream deciding to change the number without notifying anyone?
- reindeerer 4y agoThat's the whole point, source tars when properly versioned don't change. And you can get unchanged versions from any mirror in the world. sha256 of linux-2.6.10 release is 404e33da7c1bf271e0791cd771d065e19a2b1401ef8ebb481a60ce8ddc73e131, it wont change