Re: [boost] OSTIF Boost security audit report

On 5/24/24 02:07, Marshall Clow wrote:

On May 23, 2024, at 3:50 PM, Andrey Semashev via Boost wrote:

...

Also, release tarballs on GitHub don't have hashsums or signatures attached.

https://github.com/boostorg/boost/issues/838 https://github.com/boostorg/boost/issues/838

As I wrote in that issue: The archives on GitHub are not official releases.

Please stop pretending/telling people that they are.

If I could remove them entirely, I would do so. But they appear to be an artifact of the tagging process.

They are not a mere artifact of tagging. They were purposely added - first, to help CMake users (CMake-targeted tarballs have a different file layout), then to fix issues with jfrog (the b2 archives are similar to those published on jfrog, but lack documentation). My understanding is that we're moving towards releases on GitHub.