- cross-posted to:
- yt_tech@lemmy.link
- bofh@group.lt
- cross-posted to:
- yt_tech@lemmy.link
- bofh@group.lt
An exceptionally well explained rant that I find myself in total agreement with.
An exceptionally well explained rant that I find myself in total agreement with.
They could try that but I suspect it would be rather easy to find anomalies like that. These are ultimately patches to an upstream and already open-source project, so one can just diff the RHEL version with the release it’s based on and quickly notice that random GUID in the sources or random spaces/indentation. Or have multiple sources leak the code independently, and then you can diff them all between eachother to verify if you got exactly the same code or if they injected something sneaky to track it, and remove it.
Lots of companies in enterprise also want to host their own mirror because the servers are airgapped, so they can’t even track who downloaded all the sources because many companies will in fact do that. And serving slightly modified but still signed packages sounds like it would be rather computationally expensive to do on the fly, so they can’t exactly add tracking built into the packages of the repos either. And again easy to detect with basic checksumming of the files.
I don’t think that many companies have their shit together well enough to mirror the source code, besides the RHEL repos aren’t small, so that’ll cost.
The companies I’ve helped either had a minimalist mirror to reduce the surface area of what was installable or to save on cost.
It’s possible that a few enterprises do a full mirror of all RHEL sources, but i doubt it’s many
I don’t know, I’ve worked in Debian/Ubuntu companies mostly. Last two had thousands of servers and both had an apt-mirror custom repo including the deb-src ones. Otherwise we just get ourselves banned from the official mirrors when thousands of VMs pull updates from the same NAT IP.
Not sure how that works exactly on the RHEL side, maybe it’s not nearly as easy or common to do that.