3 ms·
> Unlike GitHub’s unreliable automatically generated files, a fixed file can be hashed or cryptographically signed by the project (with SSH signatures, Signify,
by ajross 4y ago
> Unlike GitHub’s unreliable automatically generated files, a fixed file can be hashed or cryptographically signed by the project (with SSH signatures, Signify, PGP, etc.), and later verified without having to extract the files first
Or how about this: Microsoft could provide that as a feature in their "official release" page for projects, which is exactly what we all thought that page was for in the first place.
Seriously: if archive links are unreliable they're basically useless anyway. Who wants tarballs in the modern world except for package management or build automation?
- Arnavion 4y agoPeople who want the source code but don't have `git`. It's also why downloading as a ZIP is also an option.
- JonChesterfield 4y agoPeople who want the source code, don't have git, and won't get git in order to get the source code, sounds like the empty set. Though zip makes me think of windows, so maybe over there. The world of perforce.
- altfredd 4y agoWhat about people who don't have Git and want to build it from source?
- hgsgm 4y agoWhy? I don't need git for my local personal use of the software, but I do need the source code if I need to modify the software. Some people even downloaded source code even before git existed.
- jenadine 4y agoYou need a compiler and a bunch of other build tools. Why not git?