Re:GIMP: Targeted Attack via a Google Ad
by mikemcquaid on Sunday October 30, 2022 @04:31AM
(#33392404)
> I don't really have a solid solution to this
My solution to this when designing Homebrew’s binary packages was to store the checksums for the binaries in Git but the binaries themselves elsewhere (inspired by Homebrew already storing source checksums in Git).
On Homebrew, therefore, you’d have to compromise both the binaries and the Git repository.
These are both nowadays on GitHub but the binaries in GitHub Packages are addressed by their checksum and the Git repository has a good audit log.
My solution to this when designing Homebrew’s binary packages was to store the checksums for the binaries in Git but the binaries themselves elsewhere (inspired by Homebrew already storing source checksums in Git).
On Homebrew, therefore, you’d have to compromise both the binaries and the Git repository.
These are both nowadays on GitHub but the binaries in GitHub Packages are addressed by their checksum and the Git repository has a good audit log.