apple / apple/foundationdb

FDB Binaries tarball on the website can be spuriously regenerated

Open
#1,970 0 comments 1 reaction 1 assignee Claimed by @AlvinMooreSr View on GitHub
Dominant language
C++
Stars
16.7k
Forks
1.6k
Avg merge
1d 20h
Merged PRs (30d)
126

Description

As noted in https://forums.foundationdb.org/t/checksum-changed/1570, it appears that it's possible for our public website deployment process to accidentally regenerate the binaries tarball. This changes the published hash of the file, and is thus indistinguishable from a malicious replacement of the file.

We need to publish this tarball as part of the build of a release, and not as part of the website build, so that we have a single, known good, verified tarball of binaries that will never change for a given release.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.