Re: OSTIF Boost security audit report

From: Marshall Clow (mclow.lists_at_[hidden])
Date: 2024-05-23 23:26:17

On May 23, 2024, at 4:24 PM, Vinnie Falco via Boost <boost_at_[hidden]> wrote:
> 
> On Thu, May 23, 2024 at 4:22 PM Sam Darwin via Boost <boost_at_[hidden]>
> wrote:
> 
>>> If I could remove them entirely, I would do so.
>>> But they appear to be an artifact of the tagging process.
>> 
>> As Andrey said, they are not a mere artifact of tagging. They were
>> purposely added, and maintained in the github actions script
>> release-cmake.yml.
>> 
> 
> How about...maybe we can write a new script, a policeman of sorts who
> compares the release artifacts with the actual releases, and deletes any
> GitHub artifact which is not bitwise identical to an Official Release? This
> way it is guaranteed that all artifacts are in fact Actual Releases.

I’m pretty sure that Andrey said that they are purposely different from the official release.

— Marshall