{"thread":{"id":"59582","subject":"criteria for linking to binaries from git-scm.com?","startedAt":"2023-04-12T08:00:30Z","lastAt":"2023-04-13T13:44:41Z","messageCount":3,"participants":["Jeff King","brian m. carlson","Derrick Stolee"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"475201","messageId":"20230412080019.GA2172825@coredump.intra.peff.net","threadId":"59582","inReplyTo":null,"subject":"criteria for linking to binaries from git-scm.com?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2023-04-12T08:00:19Z","receivedAt":"2023-04-12T08:00:30Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"There's an interesting question raised in an issue in the git-scm.com\nrepo that I think would benefit from input from community folks here.\n\nThe link is:\n\n  https://github.com/git/git-scm.com/issues/1774#issuecomment-1504829495\n\nbut the tl;dr is:\n\n  From a supply chain perspective, what are our criteria for linking to\n  a third party's pre-built binaries from git-scm.com?\n\nObviously we don't want to point people at malicious or trojaned\nbinaries. But we probably also bear some responsibility for making sure\nthe third party has reasonable security practices themselves.\n\nI don't have a strong opinion myself, and this is probably a giant can\nof worms. But it seemed like the kind of thing that should be getting\nattention from the greater community, and not just languishing in that\nrepo (both to set a policy for new requests, but also maybe to evaluate\nexisting binaries we point to).\n\n-Peff\n"},{"id":"475261","messageId":"ZDdMKNJ/4njF0Jdp@tapette.crustytoothpaste.net","threadId":"59582","inReplyTo":"20230412080019.GA2172825@coredump.intra.peff.net","subject":"Re: criteria for linking to binaries from git-scm.com?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2023-04-13T00:26:16Z","receivedAt":"2023-04-13T00:26:22Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2023-04-12 at 08:00:19, Jeff King wrote:\n> There's an interesting question raised in an issue in the git-scm.com\n> repo that I think would benefit from input from community folks here.\n> \n> The link is:\n> \n>   https://github.com/git/git-scm.com/issues/1774#issuecomment-1504829495\n> \n> but the tl;dr is:\n> \n>   From a supply chain perspective, what are our criteria for linking to\n>   a third party's pre-built binaries from git-scm.com?\n\nI think we should ideally suggest distribution binaries where those are\nautobuilt and the distributor is complying with the license.  For macOS,\nApple is providing their own binaries, and if people want more\nup-to-date versions, we could suggest Homebrew.  For Linux and BSD\nsystems, that would be pointing people to their OS distributor.\n\nFor Windows, I think most people are going to use Git for Windows and I\ndon't believe Microsoft is providing its own binaries as part of the OS.\nI believe Git for Windows is autobuilt using CI.\n\n> Obviously we don't want to point people at malicious or trojaned\n> binaries. But we probably also bear some responsibility for making sure\n> the third party has reasonable security practices themselves.\n\nThis is why I suggested autobuilt binaries only.  Typically OS\ndistributors have some sort of reasonably well secured autobuild\ninfrastructure.  I think it's safe to assume major distros have secured\ntheir autobuild infrastructure unless we've seen evidence to the\ncontrary, because otherwise we'd need to be security auditors, which I\ndon't want to be.  Note that I wouldn't object if the binaries are\nmanually signed (say, because the key lives on a human's security key),\nbut I feel like that's practically unlikely for most OS distributors.\n\nIf we have evidence that people are not complying with the license, then\nwe should refuse to link to those binaries and not recommend that as a\ntrusted source.\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"475299","messageId":"bdd76013-8cb8-ceaa-7ea0-55de3e1fbad4@github.com","threadId":"59582","inReplyTo":"ZDdMKNJ/4njF0Jdp@tapette.crustytoothpaste.net","subject":"Re: criteria for linking to binaries from git-scm.com?","fromName":"Derrick Stolee","fromEmail":"derrickstolee@github.com","sentAt":"2023-04-13T13:43:07Z","receivedAt":"2023-04-13T13:44:41Z","isPatch":false,"sender":{"key":"stolee@gmail.com","avatar":"https://avatars.githubusercontent.com/u/570044?v=4"},"body":"On 4/12/2023 8:26 PM, brian m. carlson wrote:\n> On 2023-04-12 at 08:00:19, Jeff King wrote:\n>> There's an interesting question raised in an issue in the git-scm.com\n>> repo that I think would benefit from input from community folks here.\n>>\n>> The link is:\n>>\n>>   https://github.com/git/git-scm.com/issues/1774#issuecomment-1504829495\n>>\n>> but the tl;dr is:\n>>\n>>   From a supply chain perspective, what are our criteria for linking to\n>>   a third party's pre-built binaries from git-scm.com?\n> \n> I think we should ideally suggest distribution binaries where those are\n> autobuilt and the distributor is complying with the license.  For macOS,\n> Apple is providing their own binaries, and if people want more\n> up-to-date versions, we could suggest Homebrew.  For Linux and BSD\n> systems, that would be pointing people to their OS distributor.\n\nAnd on this note, https://git-scm.com/download/mac lists\n\n  Binary installer\n  Tim Harper provides an installer for Git. The latest version is\n  2.33.0, which was released over 1 year ago, on 2021-08-30.\n\nPerhaps it is time to drop this reference?\n\nThanks,\n-Stolee\n"}]}