Re: Three steps we could take to make supply chain attacks a bit harder

2024-04-01 Thread François Rigault
> Those blobs were not in systemd, that was not my point, nevertheless putting it this way: nobody knows. For the example about compression methods you could generate your binary using a piece of code, that can be reviewed (maybe using a fixed seed as inspired by https://git.rootprojects.org/roo

Re: Three steps we could take to make supply chain attacks a bit harder

2024-04-01 Thread François Rigault
To echo > To trust code, it needs to be reviewed. > If the code is reviewed, and the build system is sane, [..] I deduce from your response that the binary tests committed in systemd were not reviewed neither by co-maintainers nor by downstream package maintainers. I understand that the build

Re: Three steps we could take to make supply chain attacks a bit harder

2024-03-31 Thread François Rigault
hi Zbyszek, how did you review the corrupted journal files committed in systemd? Can you know for certain that they do not contain any backdoor or anything illegal or unlicensed? -- ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe