News for hackers. Stuff that matters.

A comment on Timeline of the xz open source attack. Parent comment

Re:Timeline of the xz open source attack by dboreham on Tuesday April 02, 2024 @11:59AM (#39907254)
Yes the whole "let's take a mystery meat tarball from a repo that isn't the project repo" seems suspect.

Github+ even has a scheme for signing artifacts such that you have some level of trust they came from inside their Actions system, derived from some git commit. This would allow the benefits of a modular build for a large product like a distro, while preserving a chain of trust in its component parts.

+Not advocating a dependency on Github per se -- the same sort of artifact attestation scheme could be implemented elsewhere.

[ Parent | on HN ]
Re:Timeline of the xz open source attack by shp0ngle on Tuesday April 02, 2024 @12:43PM (#39907834)
as I wrote in a different thread, some projects don't have any source control.

From the big ones - 7z, ncurses are both tarballs only.

[ Parent | on HN ]
Re:Timeline of the xz open source attack by patmorgan23 on Tuesday April 02, 2024 @02:19PM (#39909074)
They need to join us in the 80s and start using source control.
[ Parent | on HN ]
Re:Timeline of the xz open source attack by account42 on Wednesday April 10, 2024 @09:13AM (#39990329)
Yeah lets make the entire open source ecosystem reliant on Microsoft. No thanks.
[ Parent | on HN ]