Re:Git archive checksums may change
by bentley on Monday January 30, 2023 @06:57PM
(#34588577)
We’ve regressed from the previous norm of open source projects providing stable source tarballs with fixed checksums, sometimes even with cryptographic signatures.
[ Parent
| on HN ]
Re:Git archive checksums may change
by reindeerer on Monday January 30, 2023 @08:13PM
(#34589434)
That norm still exists, and it's offered by Github in form of Github Releases feature as well.
It's the downstream tooling ( i.e. all the builds and package managers ) that need to clean their act up.
Re:Git archive checksums may change
by JonChesterfield on Tuesday January 31, 2023 @06:52AM
(#34593976)
If the source tar changes, how do you propose the downstream tooling distinguishes between data corruption, MITM attack and upstream deciding to change the number without notifying anyone?
Re:Git archive checksums may change
by reindeerer on Sunday February 05, 2023 @07:07PM
(#34671390)
That's the whole point, source tars when properly versioned don't change. And you can get unchanged versions from any mirror in the world. sha256 of linux-2.6.10 release is 404e33da7c1bf271e0791cd771d065e19a2b1401ef8ebb481a60ce8ddc73e131, it wont change