Re: [ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4

[Alexander Dahl via ptxdist <ptxdist@pengutronix.de>]

Hello Michael,

Am Sat, Sep 19, 2026 at 09:05:28AM +0200 schrieb Michael Olbrich:
> On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote:
[…]
> > Notes:
> >     Not sure what security gain we have from tarballs created by GitHub?
> 
> It helps detecting supply chain attacks. The "make dist" archive is
> basically impossible to reproduce, so we need to trust the uploader that it
> was not modified. For the git tarball, all changes are visible in the
> commit history. While someone still needs to look, it's much easier to spot
> something.
> And that is not theoretical: The xz backdoor did just that with a modified
> build-to-host.m4.
> 
> >     This just makes packaging harder.
> 
> I'm not sure what you mean with that.

Usually upstream publishes sha256 sums and gpg signatures along a
tarball release.  I usually check those, and compare with the sums
other distributions (e.g. buildroot) have in their packages.  If we
take the generated tarball from git, those checks are impossible.

Greets
Alex