News for hackers. Stuff that matters.

A comment on Git archive checksums may change. Parent comment

Re:Git archive checksums may change by JonChesterfield on Tuesday January 31, 2023 @06:52AM (#34593976)
If the source tar changes, how do you propose the downstream tooling distinguishes between data corruption, MITM attack and upstream deciding to change the number without notifying anyone?
[ Parent | on HN ]
Re:Git archive checksums may change by reindeerer on Sunday February 05, 2023 @07:07PM (#34671390)
That's the whole point, source tars when properly versioned don't change. And you can get unchanged versions from any mirror in the world. sha256 of linux-2.6.10 release is 404e33da7c1bf271e0791cd771d065e19a2b1401ef8ebb481a60ce8ddc73e131, it wont change
[ Parent | on HN ]