Looks like it's the apicredentials.h. Is this really the best way to distribute these? They must not be very secret since they're still in the .tar.xz.

I also think about this incident that could just as easily happen here, this has set us up for the same exact scenario: https://en.wikipedia.org/wiki/XZ_Utils_backdoor#:~:text=This modified file was not present in the git repository%3B it was only available from tar files

@jasmint the 1.2.29 release notes indicate that to build from source you should use the .tar.xz file located in the release assets, which includes an apicredentials.h file (not present in the git source tarball). Does using the .tar.xz get you all the way there?

(which builds directly from git)

Maybe it builds from the git .tar.xz asset not truly directly from git which, if so, you can ignore me.

The latest release has this note at the top

When building from source, use the official strawberry-1.2.29.tar.xz, not the auto-generated .tar.gz or .zip

What is different about the .tar.xz file?
Why is it preferred over the autogenerated .tar.gz/.zip (which is just a collection of the files in the repo)?