[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: gr-iqbal, gr-fosphor, gr-osmosdr updated to Gnuradio 3.8
From: |
Andrej Rode |
Subject: |
Re: gr-iqbal, gr-fosphor, gr-osmosdr updated to Gnuradio 3.8 |
Date: |
Wed, 8 Jan 2020 17:59:14 +0100 |
Hi Phil,
> >
> > You either need to make and host your own, or download from the
> > github mirror ( https://github.com/osmocom/gr-iqbal/releases )
>
> Standard warning, github is known to regenerate tarballs with
> different contents that lead to sha has mismatches with time making
> it hard to validate the downloaded tarball. Don't depend on githb
> downloaded tarballs if you care about supply chain integrity.
This is a bit imprecise: The contents of the tarball are not
different, but rather are timestamps might differ for _automatic_
generated tarballs. This is due to GitHub sometimes regenerating
tarballs on the fly.
If a release tarball is created manually and
uploaded as asset for a release tag there is no problem.
Cheers
A
pgp2jHv6tyPUR.pgp
Description: OpenPGP digital signature