potiuk commented on PR #37: URL: https://github.com/apache/tooling-actions/pull/37#issuecomment-5744686991
> Yes, a binary release and not source. ATR does checks to see that source releases have no binaries and that every file matches the same file in the source repository which is a superset of the source release. But cna a PMC verify that? I think very basic issue here is that we have to trust **something else** than personal check done by a few people > For binaries we count on voters inspecting artifacts for surprises by doing their own builds from source. That is a key component to preventing the xz case. The xz was actually source artifact - not binary. Look it up. In case of `xz` the problem was not binary artifact - but source .tar.gz published by the roque release manager - and many distros were **almost** infected because they used that .tar.gz as source and they had no way to verify that it was reproducible from the git repo. Look it up please - binary artifacts had nothing to do with it. > BTW - this discussion should be on a mailing list. Which one? I am happy to start it - but I just want to say - as one of the users of the tools - that I would find this one as an extremely useful tool from tooling - and very usable. But if you think we should have a mailing list discussion on that - I think it's a good idea to tell Piotr where he can raise it and how. I will chime-in as a user. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
