13
GitHub provides feature for immutable releases (docs.github.com)
submitted 1 year ago by to c/opensource@programming.dev
1 comment fedilink hide all child comments
 

Immutable releases are releases where the assets and associated Git tag cannot be changed after publication. The use of this type of release increases security by blocking supply chain attacks.

Attackers cannot:

  • Inject vulnerabilities or malware into current project releases.
  • Make changes to assets and tags that may break developer workflows.

The releases tags and artefacts can be also cryptographically verified.

1 comment

sorted by: hot top controversial new old
[–] 3 points 1 year ago

That sounds good

  • permalink
  • fedilink
  • source
    •
    7 comments in c/opensource@lemmy.ml view that post
    [–] 3 points 1 year ago* (5 children)

    So what happens when the files/code is attached to the immutable? Like a virus library bundled up forever in a release?

    If the releases can NEVER be deleted, then wouldn't it be even worse for admins? Or am I missing something?

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] [S] 13 points 1 year ago (4 children)

    You can delete a release. But you can’t change the associated tag and the attached artefacts.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 year ago (3 children)

    Can you not create another release by the same name?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 10 points 1 year ago

    The release tags cannot be changed or removed from the commit they were applied to. You cannot reuse a tag.

    Immutable releases include protection against repository resurrection attacks. Even if you delete a repository and create a new one with the same name, you cannot reuse tags that were associated with immutable releases in the original repository.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 year ago

    Tags are locked to a specific commit. So you won’t be able to create a different release with the same tag. Even deleting the repo and creating a new one won’t allow you to reuse the same tag, unless you change the repo name.

    Immutable releases include protection against repository resurrection attacks. Even if you delete a repository and create a new one with the same name, you cannot reuse tags that were associated with immutable releases in the original repository.

    https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

  • permalink
  • fedilink
  • source
  • parent
    • [–] 1 point 1 year ago

    How about IPv6 first?!

  • permalink
  • fedilink
  • source
    •