VSCodium – Libre Open Source Software Binaries of VS Code

Re:VSCodium – Libre Open Source Software Binaries of VS Code by dataflow on Monday September 04, 2023 @01:55PM (#37383063)

I've never tried this, but in theory, if these projects produce builds on GitHub Actions and you trust Microsoft's security, then you should be able to just look at the commit hash that got pulled in the action and diff that against upstream and just study that. If the diff looks safe [1] then I think that implies the binary can be trusted.

[1] Of course this includes ensuring it doesn't e.g. pull anything from the internet whose integrity you can't similarly guarantee...

[ Parent | on HN ]

Re:VSCodium – Libre Open Source Software Binaries of VS Code by krick on Monday September 04, 2023 @03:14PM (#37383887)

Somebody please bother to explain why this is downvoted. The reasoning seems perfectly valid. Of course, there are a lot of ways how somebody could fuck up, but in theory automated builds on github have the same trustworthiness guarantees as Microsoft's very own VSCode binaries.

[ Parent | on HN ]