disable: allow to disable due to checksum mismatch #12437
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The rationale is that a checksum mismatch is a huge security issue. This means that the current source file, but maybe the initial one, might have been compromised. In the case upstream does not respond quickly to clarify what happened, or fails to respond, we can now rev-bump the formula, disable and unbottle it, making sure we stop delivering the potentially malicious code Further improvements: - Add the url of the project in the error message to redirect users to the closed pull request where we disabled this, to centralize the discussion and avoid the opening of multiple new issues - Add a warning on brew-update that something is fishy upstream
|
Review period will end on 2021-11-16 at 19:26:27 UTC. |
BrewTestBot
added
waiting for feedback
MikeMcQuaid
approved these changes
Nov 16, 2021
MikeMcQuaid
added
the
critical
|
Makes sense to me 👍🏻 |
|
Review period skipped due to |
BrewTestBot
removed
the
waiting for feedback
BrewTestBot
approved these changes
Nov 16, 2021
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The rationale is that a checksum mismatch is a huge security issue.
This means that the current source file, but maybe the initial one,
might have been compromised.
In the case upstream does not respond quickly to clarify what happened,
or fails to respond, we can now rev-bump the formula, disable and unbottle it,
making sure we stop delivering the potentially malicious code
Further improvements:
Add the url of the project in the error message to redirect users to
the closed pull request where we disabled this, to centralize the discussion
and avoid the opening of multiple new issues
Add a warning on brew-update that something is fishy upstream
Have you followed the guidelines in our Contributing document?
Have you checked to ensure there aren't other open Pull Requests for the same change?
Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes? Here's an example.
Have you successfully run
brew stylewith your changes locally?Have you successfully run
brew typecheckwith your changes locally?Have you successfully run
brew testswith your changes locally?