←back to thread

Leaked admin access token to Python, PyPI, and PSF GitHub repos

(jfrog.com)
114 points elchief | 1 comments | 12 Jul 24 00:34 UTC | HN request time: 0.21s | source
Show context
oakpond ◴[12 Jul 24 11:00 UTC] No.40944423[source]▶
Yikes, TIL: never build production artifacts from a development checkout?
replies(2): >>40947730 #>>40948087 #
1. vetrom ◴[12 Jul 24 18:21 UTC] No.40948087[source]▶
This, in part, is why distributions like Debian go to the trouble they do to build everything from more-or-less isolated sourcecode artifacts.

Sure, its not always perfect, and getting say, blobless, is a challenge of its own, but no distro in their right mind for example, would ship arbitrary .o or ld.so objects in source packages.