Hi
On Tue, Apr 23, 2024 at 07:04:08PM +0000, Javier Matos Denizac via ffmpeg-devel wrote: > Dear FFmpeg team, > > > My name is Javier Matos, and I am part of the vcpkg team at Microsoft. vcpkg > is an open-source package manager designed to help developers manage C++ > libraries across platforms in a consistent manner. > > I am reaching out to inquire if FFmpeg could host an official GitHub mirror > for the `rtmpdump` repository on `github.com/FFmpeg`. > > Currently, vcpkg uses a mirrored version from `github.com/mirror/rtmpdump`, > which is not maintained by the original authors, posing a significant supply > chain risk due to potential unauthorized modifications. > > Alternatively, while we could switch to using the repository at > `git://git.ffmpeg.org/rtmpdump.git`, this source lacks support for SHA512 > checksums, complicating asset caching and security verification crucial for > ensuring the integrity of the code during downloads. Can you elaborate what the problem is ? I would have thought https://git.ffmpeg.org/rtmpdump.git is secure thx [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB In a rich man's house there is no place to spit but his face. -- Diogenes of Sinope
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
