Notices by Paul Meyer (katexochen@infosec.exchange)

TIL: `git archive` is used by GitHub and other forges to create an archive of a repo to download. git can do unexpected thing when creating such archive, like variable substitution using the `export-subst` feature. So even if a commit is immutable, you can still download different content if a ref or tag changed.

https://git-scm.com/docs/git-archive/2.46.0#Documentation/git-archive.txt-export-subst

Example: https://github.com/smallstep/cli/blob/master/.VERSION

That's a real problem in context of reproducible builds (or just source-pinning in general).

#ReproducibleBuilds #nixpkgs #nix #git #github