3 ms·
Commit scanning probably wouldn't have caught this, since the backdoor happened outside of any commit. Comparing the tarball's contents against the VCS reposit
by yellowapple 2y ago
Commit scanning probably wouldn't have caught this, since the backdoor happened outside of any commit.
Comparing the tarball's contents against the VCS repository would've likely made this easier to catch, but at that point you might as well just use the VCS repository directly.
- a-dub 2y agoi wonder if an llm could have spotted the malicious patches to autotools in the dist tarball... a public, deterministic and assured build facility for oss would be cool. also maybe a deprecation of autotools.