2 ms·
Submodules are pinned by commit hash. It prevents an attacker from replacing a release.
by Ferret7446 11mo ago
Submodules are pinned by commit hash. It prevents an attacker from replacing a release.
- parlortricks 11mo agoThat is very handy to know.
- cdegroot 11mo agoYou can achieve roughly the same by writing down the SHA256 hash the first time you download and then comparing when you download the next time. But, yeah, while I do not like submodules, for vendoring stuff it seems a reasonable approach. There's also https://github.com/fosskers/vend https://github.com/fosskers/vend if you lean that way.