5 ms·
You are quoting Jia Tan [1]. The malicious actor wrote that comment when deliberately breaking the check in the first place. Fixing headers or extra tests woul
by missblit 2y ago
You are quoting Jia Tan [1]. The malicious actor wrote that comment when deliberately breaking the check in the first place.
Fixing headers or extra tests would not have prevented this, as there is no indication the headers were broken in the first place, and extra tests could have been compromised (or ignored for release tarball) some other way.
[1] https://git.tukaani.org/?p=xz.git;a=commit;h=328c52da8a2bbb81307644efdb58db2c422d9ba7 https://git.tukaani.org/?p=xz.git;a=commit;h=328c52da8a2bbb8...
- manwe150 2y agoShould the better fix then to have been to revert the bad commit with the malicious commit message, rather than just deleting the dot (as was done)?
- humanrebar 2y agoThe better fix would be to move to proper dependency management and depend on a version range of a dependency instead of hoping you can do a better job of modelling the same with strings hardcoded into a CMakeLists.txt.