undefined | Better HN

0 pointsleni53611mo ago0 comments

The question is whether recursive submodule checkout happens after some integrity/signature validation or before. The RCE can be an issue in the latter case.

0 comments

2 comments · 1 top-level

johncolanduoni11mo ago· 1 in thread

There would also have to be a compromise of the transport (i.e. a MITM of HTTPS or SSH) to use this in most practical scenarios.

leni536OP11mo ago

It still weakens the security, otherwise why bother with integrity/signature checks if you trust the git remote?

j / k navigate · click thread line to collapse