Post #2096835
2024-03-29 19:38 UTC
@AndresFreundTec I feel both confident and also kind of queasy when saying this: it seems extremely likely that this is not the first time something like this has happened, it's just the first time we have been lucky enough to notice.
Replies (1)
-
@lispi314@udongein.xyz 2024-03-29 22:41
@glyph @AndresFreundTec That is true. Binary artifacts have no business existing in Free Software (or near-binary considering how auditable pre-generated config scripts end-up being). The way it was compromised in this case is almost certain to have happened before and reminds me of the SourceForge malware debacle (so arguably that's another famous example of it happening before). I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source.