Re: criteria for linking to binaries from git-scm.com?

From: Derrick Stolee <derrickstolee@github.com>
Date: Apr 13, 2023, 13:43 UTC
Message-ID: <bdd76013-8cb8-ceaa-7ea0-55de3e1fbad4@github.com>
In-Reply-To: <ZDdMKNJ/4njF0Jdp@tapette.crustytoothpaste.net>

On 4/12/2023 8:26 PM, brian m. carlson wrote:

Show 18 quoted lines

> On 2023-04-12 at 08:00:19, Jeff King wrote:
>> There's an interesting question raised in an issue in the git-scm.com
>> repo that I think would benefit from input from community folks here.
>>
>> The link is:
>>
>>   https://github.com/git/git-scm.com/issues/1774#issuecomment-1504829495
>>
>> but the tl;dr is:
>>
>>   From a supply chain perspective, what are our criteria for linking to
>>   a third party's pre-built binaries from git-scm.com?
> 
> I think we should ideally suggest distribution binaries where those are
> autobuilt and the distributor is complying with the license.  For macOS,
> Apple is providing their own binaries, and if people want more
> up-to-date versions, we could suggest Homebrew.  For Linux and BSD
> systems, that would be pointing people to their OS distributor.

And on this note, https://git-scm.com/download/mac lists

  Binary installer
  Tim Harper provides an installer for Git. The latest version is
  2.33.0, which was released over 1 year ago, on 2021-08-30.

Perhaps it is time to drop this reference?

Thanks, -Stolee