search

Fleex255 / PolicyPlus

Local Group Policy Editor plus more, for all Windows editions
Creative Commons Attribution 4.0 International
1.52k stars 109 forks source link

How to verify the authenticity and integrity of builds from Release and S3 Bucket pages? #65

Closed SimplyYummy closed 1 year ago

SimplyYummy commented 1 year ago

Hi @Fleex255,

First of all, thank you for developing and maintaining PolicyPlus.

While reading through issue #49, I noticed that the GitHub Actions logs for the "compute hash" step have expired and are no longer available. I might be looking in the wrong place, or perhaps I'm missing a step. Here's an example URL:

https://github.com/Fleex255/PolicyPlus/actions/runs/2423806010/jobs/3674388980

Could you please guide me on how to verify the build, or suggest any alternative methods for verifying the authenticity and integrity of the downloaded build from your S3 bucket or builds on the Release page?

Thank you!

Fleex255 commented 1 year ago

You're looking in the right place. Unfortunately, it seems GitHub Actions removes the logs after some time, and since I haven't made any code changes in a while, there aren't any available logs. I just enabled manual Actions runs so I can, if necessary, produce a new verified build of existing code in the future. Here is today's log.

Relevant GitHub feature request: Always keep last workflow run log.

SimplyYummy commented 1 year ago

Thank you! Much appreciated