Don't keep OpenSSL binaries in source control. Do make it easy to build them. #11

Closed
opened 2024-02-20 12:36:08 -05:00 by cory · 2 comments
Owner

I pretty much just intend to automate what tools/ssl-android and friends do as an optional part of the makefile.

I pretty much just intend to automate what `tools/ssl-android` and friends do as an optional part of the makefile.
Contributor

Including prebuilt versions of anything (bundled js files included) is a massive security risk (are you sure I'm not introducing malware in #1 by modifying cm6.js ?). It does make building the app a lot easier, but it's not worth it in the long-term.

https://en.wikipedia.org/wiki/Supply_chain_attack

Including prebuilt versions of anything (bundled js files included) is a massive security risk (are you sure I'm not introducing malware in #1 by modifying cm6.js ?). It does make building the app a lot easier, but it's not worth it in the long-term. https://en.wikipedia.org/wiki/Supply_chain_attack
Author
Owner

Yeah, I haven't been distributing them with the source tarballs for that reason, but now that the full tree is public, things need to be better.

Yeah, I haven't been distributing them with the source tarballs for that reason, but now that the full tree is public, things need to be better.
cory closed this issue 2024-02-21 20:24:19 -05:00
cory added this to the 0.0.16 milestone 2024-02-21 20:24:58 -05:00
Sign in to join this conversation.
No Label
No Milestone
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: cory/tildefriends#11
No description provided.