Hello Michael, Am Sat, Sep 19, 2026 at 09:05:28AM +0200 schrieb Michael Olbrich: > On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote: […] > > Notes: > > Not sure what security gain we have from tarballs created by GitHub? > > It helps detecting supply chain attacks. The "make dist" archive is > basically impossible to reproduce, so we need to trust the uploader that it > was not modified. For the git tarball, all changes are visible in the > commit history. While someone still needs to look, it's much easier to spot > something. > And that is not theoretical: The xz backdoor did just that with a modified > build-to-host.m4. > > > This just makes packaging harder. > > I'm not sure what you mean with that.
Usually upstream publishes sha256 sums and gpg signatures along a tarball release. I usually check those, and compare with the sums other distributions (e.g. buildroot) have in their packages. If we take the generated tarball from git, those checks are impossible. Greets Alex
