Re: backdoor injection via release tarballs combined with binary artifacts (was Re: Backdoor in upstream xz-utils)

[Andreas Enge]

Am Thu, Apr 11, 2024 at 02:56:24PM +0200 schrieb Ekaitz Zarraga:
> I think it's just better to
> obtain the exact same code that is easy to find

The exact same code as what? Actually I often wonder when looking for
a project and end up with a Github repository how I could distinguish
the "original" from its clones in a VCS. With the signature by the
known (this may also be a wrong assumption, admittedly) maintainer
there is at least some form of assurance of origin.

> and everybody is reading.

This is a steep claim! I agree that nobody reads generated files in
a release tarball, but I am not sure how many other files are actually
read.

Andreas