[boost] Re: Potential risks in Boost testing and release workflow

On September 14, 2025 12:08:49 PM Mohammad Nejati via Boost <boost@lists.boost.org> wrote:

For example, the final machine that publishes shared libraries or Boost archives should not run tests.

I may be mistaken, but I don't think running tests is part of the release process. Building documentation is, though, and that may involve some scripts and XSLTs provided by libraries. I'm not sure about high security concern about compromising Boost distribution as a whole. Hacking individual libraries seems more likely. But it is possible to break entire Boost build by an erroneous change in a single library, and it would be nice if this was mitigated.