Re: OSTIF Boost security audit report

From: Vinnie Falco (vinnie.falco_at_[hidden])
Date: 2024-05-23 23:24:28

On Thu, May 23, 2024 at 4:22 PM Sam Darwin via Boost <boost_at_[hidden]>
wrote:

> > If I could remove them entirely, I would do so.
> > But they appear to be an artifact of the tagging process.
>
> As Andrey said, they are not a mere artifact of tagging. They were
> purposely added, and maintained in the github actions script
> release-cmake.yml.
>

How about...maybe we can write a new script, a policeman of sorts who
compares the release artifacts with the actual releases, and deletes any
GitHub artifact which is not bitwise identical to an Official Release? This
way it is guaranteed that all artifacts are in fact Actual Releases.

Thanks