Skip to content

Notice: Future Deprecation of setup-bin Due to Security Concerns #539

Description

@HarryGogonis

Notice: Future Deprecation of setup-bin

We are considering deprecating this action in the future.

Rationale:

  • Due to the increasing prevalence of supply chain attacks, we cannot recommend using setup-bin going forward.
  • The current approach makes the process of updating binaries and tracking CVE status more opaque.
  • The URLs used to fetch binaries can change at any time, and this action does not enforce SHA256 (or similar) checksums, increasing the risk that supplied binaries could be altered or compromised without detection.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions