5 ms·
> With those modifications, it then builds Python from source across a wide matrix of Python versions, platforms, and build variants (e.g., optimized vs. debug
by themusicgod1 2y ago
> With those modifications, it then builds Python from source across a wide matrix of Python versions, platforms, and build variants (e.g., optimized vs. debug builds), and publishes the built distributions to GitHub Releases.
This should be illegal.
- JackYoustra 2y agoWhy?
- cdchn 2y agoSupply chain risk.
- the_mitsuhiko 2y agoPlease explain your reasoning.
- cdchn 2y agoSomebody else is building your binaries. You've added another link in your software supply chain. How do you know they haven't inserted malware?
- the_mitsuhiko 2y ago> Somebody else is building your binaries. That happens all the time. Who builds the docker images you are using? > You've added another link in your software supply chain. How do you know they haven't inserted malware? You're installing untrusted random packages from PyPI. There are many much weaker points than Astral giving you malware for fun.
- cdchn 2y agoSure it happens, but that doesn't mean you shouldn't think about reducing it.
- maxloh 2y ago> Somebody else is building your binaries. FYI there are two parties you are talking about: Astral, and GitHub too (if you don't trust Microsoft).
- themusicgod1 2y agoPublishing to Github should be considered a crime.
- mistrial9 2y agoHow to handle this situation is literally defined in the LICENSE for any modern software project