Stephane-D / SGDK

SGDK - A free and open development kit for the Sega Mega Drive
https://www.patreon.com/SGDK
MIT License
1.77k stars 189 forks source link

Heavy dependence on non-reproducible artifacts #297

Open MightyAlex200 opened 1 year ago

MightyAlex200 commented 1 year ago

The build scripts included in this repository are heavily dependent upon the exe files in bin/, and the whole repository in general is filled with generated outputs. This is generally considered bad practice as it reduces portability, increases file size unnecessarily, produces redundant information which can quickly become out of date, and gives malicious actors the opportunity to hide malware in opaque executable files.

I am making this issue as a Linux user primarily because I don't want to have to use WINE to use a development tool which apparently has no dependence on Windows whatsoever.

Can we take steps to fix this? In particular:

Of course, all exe, a, jar, etc. files generated by source code in this repository can and should continue to be released as artifacts in Github releases.