Codecov breach impacts GoDaddy, Atlassian, P&G etc.

Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by WhyNotHugo on Sunday April 18, 2021 @05:12AM (#26850981)

You can use their bash uploaded, but you can also use language specific ones.

The Python one, for example, is downloaded via PyPI, and you’ll usually have a pinned version with the hash of it. Any tampering would make pipelines fail. If a new release were pushed by rogue actors, someone would notice an unplanned version bump.

[ Parent | on HN ]

Re:Codecov breach impacts GoDaddy, Atlassian, P&G etc. by sidmitra on Sunday April 18, 2021 @10:30AM (#26852781)

FYI their support actively asks you to move to the bash uploader from the Python one, and the Python one had other compatability issues.

Here's a snippet from a support thead with them last year:

>One thing I noticed is that you are using the python uploader to upload coverage reports to Codecov. We do not support this uploader as a first-party tool, but we do support the bash uploader (https://docs.codecov.io/v4.3.0/docs/about-the-codecov-bash-u...) with full-time staff. We want to make sure this issue isn't related to something in a third party uploader before troubleshooting further. > Would you be able to switch to using this uploader to see if it's related?

I'd stopped using codecov last year for pricing reasons, when they moved to per-user pricing.

[ Parent | on HN ]