2 ms·
except it isn't reinventing the tarball, because the git hash forces verification that every single file in the repo matches that in the release. And git even
by londons_explore 3y ago
except it isn't reinventing the tarball, because the git hash forces verification that every single file in the repo matches that in the release.
And git even has support for "compressed git repo in a file" or "shallow git repo in a file" or even "diffs from the last release, compressed in a file". They're called "git bundle"'s.
They're literally perfect for software distribution and archiving.
- bombcar 3y agoPeople don't know how to use git hashes, and it's not been "done". Whereas downloading tarballs and verifying hashes of the tarball has been "good enough" because the real thing it's been detecting is communication faults, not supply chain attacks. People also like version numbers like 2.5.1 but that's not a hash, and you can only indirectly make it a hash.