3 ms·
The changes to build-to-host.m4 weren't in the source repo, so there was no commit. The attacker had permissions to create GitHub releases, so they simply adde
by Aloisius 3y ago
The changes to build-to-host.m4 weren't in the source repo, so there was no commit.
The attacker had permissions to create GitHub releases, so they simply added it to the GitHub release tarball.
- MuffinFlavored 3y agoHow would this have made it into Debian? Part of the Debian build is to pull down a release tarball (and then build from source) and not `git clone` a repo at a specific tag and build from source?