When building from source, use the official strawberry-*.tar.xz, not the auto-generated .tar.gz or .zip
-
The latest release has this note at the top
When building from source, use the official strawberry-1.2.29.tar.xz, not the auto-generated .tar.gz or .zip
What is different about the .tar.xz file?
Why is it preferred over the autogenerated .tar.gz/.zip (which is just a collection of the files in the repo)? -
Looks like it's the apicredentials.h. Is this really the best way to distribute these? They must not be very secret since they're still in the .tar.xz.
I also think about this incident that could just as easily happen here, this has set us up for the same exact scenario: https://en.wikipedia.org/wiki/XZ_Utils_backdoor#:~:text=This modified file was not present in the git repository%3B it was only available from tar files
-
@tebriel
Do you have a better suggestion? The only other alternative as far as I can see is to have every user create their own, and that would cause hassle for a lot of users.It's not very secret, but it leaves them off the git repository, and they are obfuscated in the tar.xz, not directly in clear-text like before. This makes it more unlikely that other projects that fork of strawberry continue to use the same API credentials.
The tar.xz creation is automated through GitHub CI and attached to the release, the whole process is in the open. It's possible to compare the sha256 from the github actions job run log to the actual sha256 in the release on GitHub. There are plenty of projects that manually create and upload the source-code tarball. And I hope that Linux distros have learned from the xz backdoor and have better security to scan the code for security issues. AI has also come a long way since then.
