Re: [boost] OSTIF Boost security audit report

On May 23, 2024, at 4:24 PM, Vinnie Falco via Boost wrote:

On Thu, May 23, 2024 at 4:22 PM Sam Darwin via Boost wrote:

...

...

If I could remove them entirely, I would do so. But they appear to be an artifact of the tagging process.

As Andrey said, they are not a mere artifact of tagging. They were purposely added, and maintained in the github actions script release-cmake.yml.

How about...maybe we can write a new script, a policeman of sorts who compares the release artifacts with the actual releases, and deletes any GitHub artifact which is not bitwise identical to an Official Release? This way it is guaranteed that all artifacts are in fact Actual Releases.

I’m pretty sure that Andrey said that they are purposely different from the official release. — Marshall