Re: OSTIF Boost security audit report

From: Andrey Semashev (andrey.semashev_at_[hidden])
Date: 2024-05-23 23:10:43

On 5/24/24 02:07, Marshall Clow wrote:
> On May 23, 2024, at 3:50 PM, Andrey Semashev via Boost
> <boost_at_[hidden]> wrote:
>>
>> Also, release tarballs on GitHub don't have hashsums or signatures
>> attached.
>>
>> https://github.com/boostorg/boost/issues/838
>> <https://github.com/boostorg/boost/issues/838>
> 
> As I wrote in that issue:
> The archives on GitHub are not official releases.
> 
> Please stop pretending/telling people that they are.
> 
> If I could remove them entirely, I would do so.
> But they appear to be an artifact of the tagging process.

They are not a mere artifact of tagging. They were purposely added -
first, to help CMake users (CMake-targeted tarballs have a different
file layout), then to fix issues with jfrog (the b2 archives are similar
to those published on jfrog, but lack documentation).

My understanding is that we're moving towards releases on GitHub.