Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Paul Meyer (katexochen@infosec.exchange)'s status on Friday, 15-Nov-2024 05:41:41 JST Paul Meyer

   TIL: `git archive` is used by GitHub and other forges to create an archive of a repo to download. git can do unexpected thing when creating such archive, like variable substitution using the `export-subst` feature. So even if a commit is immutable, you can still download different content if a ref or tag changed.

   https://git-scm.com/docs/git-archive/2.46.0#Documentation/git-archive.txt-export-subst

   Example: https://github.com/smallstep/cli/blob/master/.VERSION

   That's a real problem in context of reproducible builds (or just source-pinning in general).

   #ReproducibleBuilds #nixpkgs #nix #git #github