Re: openwrt Conclusions from CVE-2024-3094 (libxz disaster)

[Bill Fenner <fenner () gmail com>]

mcr suggested:
> I wonder if we should nuke our own make tarball system.

The creation of a tarball and its signature gives a place to hang one's hat
about origin of code - "someone with the right key claims that this tarball
genuinely reflects what the project wants to distribute".  Is there a
similar mechanism for a git tag?

  Bill
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s