alt Hacker NewsYes, I scratched my head trying to understand what this accomplishes. It just puts a tag back instead of a SHA but now moves the SHA (locked in) to a separate file that now needs to be verified ? I fail to see how this is better or needed.
Yes, I scratched my head trying to understand what this accomplishes. It just puts a tag back instead of a SHA but now moves the SHA (locked in) to a separate file that now needs to be verified ? I fail to see how this is better or needed.
You can still use the SHA if you want to. What it achieves is transitive pinning (which this post doesn't properly highlight).
Lack of transitive pinning support was the biggest supply-chain security criticism against GHA and I'm glad they are finally tackling it!