33 ms·
The fact that this is causing problems seems like a flaw in Bazel, imo. Nix, for example, calculates a hash of the contents of a tarball, rather than a hash of
by hamandcheese 4y ago
The fact that this is causing problems seems like a flaw in Bazel, imo. Nix, for example, calculates a hash of the contents of a tarball, rather than a hash of the tarball itself.
- rfoo 4y agoYep, Nix not affected at all is pretty impressive. On the other hand this goes against the "verify before parse" principle so I have mixed feelings on Nix's approach.
- Foxboron 4y agoThey don't really do any source authentication at all. There is no strategy for checking gpg/minisign/whatever signatures and fetching keys to validate these things.