3 ms·
Keeping a clean, public vcs is a pain in the neck. If you're working on anything less than a large open-source project with many devs and random contributions,
by _bin_ 2y ago
Keeping a clean, public vcs is a pain in the neck. If you're working on anything less than a large open-source project with many devs and random contributions, it's a pointless hassle. Can you tell me how that makes it any sketchier than leaving a public github?
- abhinavk 2y agoPublic Github with CI means the binary was built unmodified from source. You can turn off issues/PR and push only release branches with squashed commits.
- _bin_ 2y agoAssuming you trust Github, of course. I think if someone is seriously worried code has been altered between source and maintainer-provided binary, his big concern will be the time it takes to audit the source code (which he also shouldn't trust). The build time will be inconsequential next to that.
- pabs3 2y agoThe Reproducible Builds project is working on trustworthy builds: https://reproducible-builds.org/ https://reproducible-builds.org/