Re:Webmin 1.890 Exploit – What Happened?
by johannes1234321 on Monday August 26, 2019 @05:29AM
(#20798419)
The typical reason is that one has a build chain which predates docker and those things, where it wasn't guaranteed that doing it on different machines yields the same result, but having a master host gives consistent result, independent from who does it.
In modern times the reason is that the release is produced in a CI pipeline. So once a build is green and matches allmothe rreleas criteria that tested build is released.
In both cases using a git checkout for longer time is not a got idea and builds should be done as exports into clean directories.
The way I understand releases and tarballs, I'd do it like this:
- git on my machine (supposedly safe)
- bundle the source code, sign it however necessary
- upload and publish the tarball + signature & checksums
That way, unless my own machine was compromised, it should be OK.