41 ms·
It would be odd if it didn't. Although the goal of homebrew is to execute the code in the repo. The only situation where the RCE here is a problem is if you cl
by msgodel 1y ago
It would be odd if it didn't. Although the goal of homebrew is to execute the code in the repo.
The only situation where the RCE here is a problem is if you clone github repos containing data you don't want to execute. That's fairly unusual.
- leni536 1y agoThe question is whether recursive submodule checkout happens after some integrity/signature validation or before. The RCE can be an issue in the latter case.
- johncolanduoni 1y agoThere would also have to be a compromise of the transport (i.e. a MITM of HTTPS or SSH) to use this in most practical scenarios.
- leni536 1y agoIt still weakens the security, otherwise why bother with integrity/signature checks if you trust the git remote?
- deleted 1y ago[deleted]