Groups > linux.debian.bugs.dist > #1253839

Bug#1109423: want dgit push-source --facilitate-xz-attack

From	Ian Jackson <ijackson@chiark.greenend.org.uk>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1109423: want dgit push-source --facilitate-xz-attack
Date	2025-07-24 23:00 +0200
Message-ID	<LcbcJ-2oVK-1@gated-at.bofh.it> (permalink)
References	<L9wno-ELa-9@gated-at.bofh.it> <LaCK6-1mKT-3@gated-at.bofh.it> <L9wno-ELa-9@gated-at.bofh.it> <LaCK6-1mKT-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Control: severity -1 wishlist

Colin Watson writes ("Bug#1109423: want dgit push-source --facilitate-xz-attack"):
> I made some comments about this in a tag2upload contributors BoF at 
> DebConf which contained details new to Ian, and they asked me to write 
> those details down here.

Thanks.  This is very helpful.

> While it's possible to use pristine-tar to commit deltas for tarballs 
> that are not represented by any git commit, the typical workflows that I 
> believe most Debian developers use take care to avoid that situation.  

I think that means that we can relax about this issue, and press on
with pristine-tar support.

Let's leave this bug open at wishlist, for now at least.

Ian.

-- 
Ian Jackson <ijackson@chiark.greenend.org.uk>   These opinions are my own.  

Pronouns: they/he.  If I emailed you from @fyvzl.net or @evade.org.uk,
that is a private address which bypasses my fierce spamfilter.

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1109423: want dgit push-source --facilitate-xz-attack Ian Jackson <ijackson@chiark.greenend.org.uk> - 2025-07-17 15:00 +0200
  Bug#1109423: want dgit push-source --facilitate-xz-attack Sean Whitton <spwhitton@spwhitton.name> - 2025-07-18 11:10 +0200
  Bug#1109423: want dgit push-source --facilitate-xz-attack Colin Watson <cjwatson@debian.org> - 2025-07-20 16:00 +0200
    Bug#1109423: want dgit push-source --facilitate-xz-attack Ian Jackson <ijackson@chiark.greenend.org.uk> - 2025-07-24 23:00 +0200

csiph-web