dave2wave commented on PR #37: URL: https://github.com/apache/tooling-actions/pull/37#issuecomment-5744598681
> Which is exactly the scenario that 'xz` issue hed. The release manager modified the .tar.gz artifact - it was not produced from the specific commit - it had few lines injected in build script. And reproducibility check by independent PMC members -> recreating the same .tar.gz file is the fastest and most certain way to verify that release manager preparing the artifact was not roque, blackmailed, or that someone stole their credentials and wanted to inject stuff. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
