Open xnox opened 4 months ago
i wonder if we can auto-rewrite this:
- uses: fetch
with:
expected-sha256: dfbf1dbe06d1646ed36ac740e50f27ebb76c5b7f85205918813dc60246cee655
uri: https://github.com/tzinfo/tzinfo/archive/refs/tags/v${{package.version}}.tar.gz
And fix up the commit, with a converter script.
@xnox we need to make sure the build script doesn't use any information from git, which is quite common in go.
@xnox we need to make sure the build script doesn't use any information from git, which is quite common in go.
On the contrary, I think. Most security scanners do pick up version information from binaries (and specifically go) and can provide more accurate data when VCS identifiers are present in the binaries. (SBOMs, vulnerabilities, etc.)
In part, this goal is to ensure all/most binaries come from git tags, instead of arbitrary disconnected tarballs.
@xnox we need to make sure the build script doesn't use any information from git, which is quite common in go.
On the contrary, I think. Most security scanners do pick up version information from binaries (and specifically go) and can provide more accurate data when VCS identifiers are present in the binaries. (SBOMs, vulnerabilities, etc.)
In part, this goal is to ensure all/most binaries come from git tags, instead of arbitrary disconnected tarballs.
my bad. i thought we convert git-checkout to tarball. git-checkout has more information than tarball so we're fine :)
Generated using:
$ git grep '/archive/refs/' | sed 's/: */: /g' | sed 's|^|- [ ] |'