FDB Binaries tarball on the website can be spuriously regenerated
Open
- Dominant language
- C++
- Stars
- 16.7k
- Forks
- 1.6k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 126
Description
As noted in https://forums.foundationdb.org/t/checksum-changed/1570, it appears that it's possible for our public website deployment process to accidentally regenerate the binaries tarball. This changes the published hash of the file, and is thus indistinguishable from a malicious replacement of the file.
We need to publish this tarball as part of the build of a release, and not as part of the website build, so that we have a single, known good, verified tarball of binaries that will never change for a given release.
Contributor guide
Assessment
This issue has not been assessed yet.