[1lint]

Another reason to include commit ids in the url when fetching files from external repos. I think you should do this anyways in case the external repo maintainer makes a change that silently breaks your build script

[ewhauser421]

Just verify the SHA of the tarball a la Bazel?

[glandium]

Remember when git archive changed its format and that affected archives downloaded from github?

[slimsag]

That won't help you very much. There's no guarantee the commit belongs to the named repository with e.g. raw links[0].

[0] https://twitter.com/slimsag/status/1672421999698903043

[faangsticle]

Of course it will, since you'll either get the commit you wanted at the time you wrote the script, or an error.

[bqmjjx0kac]

Unless someone is very good at finding SHA1 collisions.

[NhanH]

The collisions need to deliver malicious payload as well, making it extra hard

[manwe150]

Those are still very hard to get for a random hash, and GitHub I think warns (or blocks?) you if you try to push a hash with a known vulnerability.

[glandium]

If you clone the repo, it won't be there.