-
-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Open
Description
π Downstream build in homebrew failed with error:
Full fetch --build-from-source k9s output
β Formula k9s (0.50.9)
Error: v0.50.9 tag should be ff62f621158b8d701279f9900437021bcfa369c2
but is actually ffdc7b70f044e1f26c2f6fbb93b5495e4ebdb1ad
Indicating that the git tag v0.50.9
was moved from ff62f62 to ffdc7b7
Diff: ff62f62...ffdc7b7
The change is not just a trivial one one that would take few minutes, but spread over several days, significantly increasing the chances of causing:
- doubious meaning of the 0.50.9 bug reports,
- confusing/breaking downstream consumers, eg:
- homebrew: https://github.com/Homebrew/homebrew-core/blob/880abb8c60597558f1e30586e980f0b23b5c06e9/Formula/k/k9s.rb#L6 & k9s: v0.50.9 git revision updateΒ Homebrew/homebrew-core#232918
- nixpkgs: https://github.com/NixOS/nixpkgs/blob/85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054/pkgs/by-name/k9/k9s/package.nix#L21
- winget: https://github.com/microsoft/winget-pkgs/blob/01f3b436d61d7db9e9d86a3688fb6af341c48e0d/manifests/d/Derailed/k9s/0.50.9/Derailed.k9s.installer.yaml#L12-L17
- possibly others...
- raising security concerns (was the repository compromised and some malicious change included into an existing release?)
Moving the git tags is strongly discouraged and intentionally not trivial to do by mistake.
I kindly ask you to review the changes and confirm if this was done intentionally or maliciously. If former, i advise you to refrain from doing that in the future. π
ryandesign and arban
Metadata
Metadata
Assignees
Labels
No labels