Creating signed GitHub releases

Re:Creating signed GitHub releases by rickycook on Thursday April 14, 2016 @05:25AM (#11495267)

They missed the bit about verifying the validity of the content of the tarball... Given that you're essentially guarding against GitHub going rogue, that's half the point right?

[ Parent | on HN ]

Re:Creating signed GitHub releases by creshal on Thursday April 14, 2016 @05:38AM (#11495316)

Verifying the content is one thing, what about making sure the archive itself isn't malicious and triggering tar/gzip/zip vulnerabilities? In my experience, github's archives are not generated in a reproducible way.

[ Parent | on HN ]

Re:Creating signed GitHub releases by creshal on Thursday April 14, 2016 @09:20AM (#11496397)

Never mind that comment, as established in a different comment chain, it's an inherent limitation of zip archives. .tar.gz archives are fully reproducible.

[ Parent | on HN ]

Re:Creating signed GitHub releases by ashitlerferad on Thursday April 14, 2016 @09:31AM (#11496487)

github archives are definitely generated in a reproducible way.

[ Parent | on HN ]

Re:Creating signed GitHub releases by LukeShu on Thursday April 14, 2016 @11:42AM (#11497588)

They are now. They weren't 2 or 3 years ago.

[ Parent | on HN ]