During pnpm tauri build, the bundler fetches at build time:
github.com/tauri-apps/binary-releases/releases/download/linuxdeploy/linuxdeploy-x86_64.AppImage.../apprun-old/AppRun-x86_64raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gtk/master/linuxdeploy-plugin-gtk.shraw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gstreamer/master/linuxdeploy-plugin-gstreamer.shgithub.com/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/continuous/…
All of these are mutable references (master, continuous, re-uploadable release assets) resolved
at release-build time. Anyone who can move those upstream tags injects content into a Buzz release
build, and two builds of the same tag can legitimately differ. The workflow already digest-pins
appimagetool 1.9.1 and the type2 runtime — the same treatment (vendor or verify by sha256) should
cover these. (In my v0.5.18 rebuild they happened to still deliver compatible bytes — the final
artifacts weren't affected — but that's luck, not policy.)
During
pnpm tauri build, the bundler fetches at build time:github.com/tauri-apps/binary-releases/releases/download/linuxdeploy/linuxdeploy-x86_64.AppImage.../apprun-old/AppRun-x86_64raw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gtk/master/linuxdeploy-plugin-gtk.shraw.githubusercontent.com/tauri-apps/linuxdeploy-plugin-gstreamer/master/linuxdeploy-plugin-gstreamer.shgithub.com/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/continuous/…All of these are mutable references (
master,continuous, re-uploadable release assets) resolvedat release-build time. Anyone who can move those upstream tags injects content into a Buzz release
build, and two builds of the same tag can legitimately differ. The workflow already digest-pins
appimagetool 1.9.1 and the type2 runtime — the same treatment (vendor or verify by sha256) should
cover these. (In my v0.5.18 rebuild they happened to still deliver compatible bytes — the final
artifacts weren't affected — but that's luck, not policy.)