3 ms·
Sure, but you could achieve the same thing by requiring that the build artifacts are generated by a Github Actions runner.
by crote 2y ago
Sure, but you could achieve the same thing by requiring that the build artifacts are generated by a Github Actions runner.
- tomjakubowski 2y agoThat would only make the xz attack harder, not make it impossible. Just add some step to the action run that fetches blobs from an internet resource you control, then swap out the blobs for malicious ones.