3 ms·
Pulling directly from github is the good thing. The release tar was compromised, the sources not.
by rurban 3y ago
Pulling directly from github is the good thing. The release tar was compromised, the sources not.
- nextaccountic 3y agoIn this specific case this is true, but generally speaking Github can remove repositories for any reason (and for no reason). They provide free bandwidth so it gets used for that, it's just not trustworthy. One option for distros that compile from source (such as Gentoo, NixOS without the package cache, of Arch Linux's AUR) is to make the package system to either download from Github, or download from a distro-provided mirror if Github is down. Distros could pool together to offer a source code mirror that is common for all their users. That would be a good thing.