@bryanmacfarlane @ethomson
'There is a real binary distribution trust issue.'
That seems to be the main issue here, and ruby/ruby has never released binaries. Obviously, other languages have, but there's also several copies of OpenSSL binaries on the Windows image because OpenSSL doesn't release binaries. To my knowledge, for some of the builds one cannot even get to the build code or a log of the build behind an https CI system.
So, GH wants 'binary distribution trust', but it doesn't want to host the binaries themselves.
I think there needs to be another solution.
The build system (rbenv/ruby-build) used by use-ruby-action has a few maintainers that are GH staff.
If a repo/org account was started that was more of a 'collective' of people, could it create and host the binary builds? Not part of GH, but 'approved' by GH? Certainly could contain whatever 'due diligence, but if you really want secure' language as needed...
@bryanmacfarlane @ethomson
'There is a real binary distribution trust issue.'
That seems to be the main issue here, and ruby/ruby has never released binaries. Obviously, other languages have, but there's also several copies of OpenSSL binaries on the Windows image because OpenSSL doesn't release binaries. To my knowledge, for some of the builds one cannot even get to the build code or a log of the build behind an https CI system.
So, GH wants 'binary distribution trust', but it doesn't want to host the binaries themselves.
I think there needs to be another solution.
The build system (rbenv/ruby-build) used by use-ruby-action has a few maintainers that are GH staff.
If a repo/org account was started that was more of a 'collective' of people, could it create and host the binary builds? Not part of GH, but 'approved' by GH? Certainly could contain whatever 'due diligence, but if you really want secure' language as needed...