News for hackers. Stuff that matters.

A comment on Git archive checksums may change. Parent comment

Re:Git archive checksums may change by reindeerer on Monday January 30, 2023 @08:13PM (#34589434)
That norm still exists, and it's offered by Github in form of Github Releases feature as well.

It's the downstream tooling ( i.e. all the builds and package managers ) that need to clean their act up.

[ Parent | on HN ]
Re:Git archive checksums may change by JonChesterfield on Tuesday January 31, 2023 @06:52AM (#34593976)
If the source tar changes, how do you propose the downstream tooling distinguishes between data corruption, MITM attack and upstream deciding to change the number without notifying anyone?
[ Parent | on HN ]
Re:Git archive checksums may change by reindeerer on Sunday February 05, 2023 @07:07PM (#34671390)
That's the whole point, source tars when properly versioned don't change. And you can get unchanged versions from any mirror in the world. sha256 of linux-2.6.10 release is 404e33da7c1bf271e0791cd771d065e19a2b1401ef8ebb481a60ce8ddc73e131, it wont change
[ Parent | on HN ]