On Sun, 31 Mar 2024 at 13:55, Christopher Klooz <py0xc3(a)posteo.net> wrote:
[..]
BTW all that scandal with xz backdoor.
Looks like if fedora spec file would be using not
Source0:
https://github.com/tukaani-project/%{name}/releases/download/v%{version}/...
but
Source0:
https://github.com/tukaani-project/%{name}/archive/v%{version}/%{name}-%{...
It would be no issue.
kloczek