Re: Question about git signed tags

On Tue, 29 Nov 2022 at 07:29, Björn Persson <Bjorn(a)xn--rombobjrn-67a.se&gt; wrote: During the early days of packaging, there were a set of packages which would pull things from the internet to 'complete' the build. This led to non-repeatable builds, and in some cases security problems when a precompiled blob on sunsite.unc.edu was compromised. There were also some sets of code which tried to 'exfiltrate' things during a build. Cutting off internet access helped cut off these vectors of problems for the OS and allowed interested parties to rebuild the OS from 'scratch' as needed. It made things harder overall, but at the time was better than the alternative of having a rebuild be drastically different from the first or 'other code' added into the system without knowing why. tl;dr: There is always a percentage of jerks out there who like to make life miserable for everyone else. Removing the internet helps lower their free ride. -- Stephen Smoogen, Red Hat Automotive Let us be kind to one another, for most of us are fighting a hard battle. -- Ian MacClaren