4 ms·
as i understand it, the tooling would "see" some of the questionable configs that were in the tarballs. Because they're packaged into tarballs they cant be che
by senectus1 3y ago
as i understand it, the tooling would "see" some of the questionable configs that were in the tarballs.
Because they're packaged into tarballs they cant be checked. or or to the point they use the tarballs because its much faster...
- badsectoracula 3y agoWhat tooling? Git is just a filesystem with file versions, anything you can check in a tarball can also be checked in Git. The only thing Git adds is a change history for the contents in the filesystem (a history that can be forged too - Git even has a bunch of commands for that too). If you cannot trust the authors' tarballs how can you trust their Git repository?