3 ms·
My preferred tool to solve these issues is called 'gitlab'
by rtaylorgarlock 7mo ago
My preferred tool to solve these issues is called 'gitlab'
- righthand 7mo agoCircleCI TravisCI Jenkins scripts dir Etc
- b00ty4breakfast 7mo agoyeah, github's business model is not really a git repository but a bunch of other (admittedly useful) stuff that traps people in their ecosystem.
- saxonww 7mo agoDoes it solve anything? I don't see this as a GitHub problem, it's a "we built a dependency management system with untrusted publishers" problem. GitLab's `include` feature has the same concern. They do offer an integrity check, but it's not any more capable than hash pinning to a commit. Fundamentally, if you offer a way to extend your product with externally-provided components, and you can't control the external publishers, then you've left the door open to 'these issues'.