Enable immutable releases
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 23.1k
- Forks
- 1.1k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 9
Description
Could you consider enabling immutable releases for this project? This would help protect the project's software supply chain. Once enabled:
- Git tags are locked and cannot be moved or changed.
- Release assets cannot be modified after publishing.
This protects against supply chain attacks where an attacker injects malware into an existing release or modifies assets after the fact. For more details, see the GitHub documentation: Immutable releases.
Note: Immutability only applies to future releases. After enabling this feature, all existing releases will need to be re-saved individually to make them immutable as well.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked GitHub documentation on immutable releases and inspect the repository's release settings. Enable immutability for future releases, then re-save existing releases individually as noted in the issue; done means tags and assets cannot be changed after publication.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100