3 ms·
For sure, which is one of the big benefits of git + git tagging, but the issue is even if you know you received the same binary as someone else, without reprodu
by tristor 2y ago
For sure, which is one of the big benefits of git + git tagging, but the issue is even if you know you received the same binary as someone else, without reproducible and auditable builds, you have no idea if that binary originated from the same code in the case of a targeted attack.
- Terr_ 2y ago> For sure, which is one of the big benefits of git + git tagging That's not enough for serious security though, because git is (still) using SHA1 instead of SHA256. You would need something extra, like a signed commit. There's also the much simpler pitfall of an attacker just creating a branch named the same as a commit, in the hopes that people will accidentally check it out instead.
- namibj 2y agoThen use git in sha2 mode. You just have to turn that on.