Image used to build binary blobs is not published

[faddat]

Because this image is not published, it is not possible to fully understand how the .so files in this repository come to exist.

This could allow for the silent introduction of vulnerabilities and harms reproducibility.

[faddat]

I will just make a GitHub actions that publishes, and then builds will be verifiable

[chipshort]

What are you talking about? The image is clearly defined in our circleci config:

wasmvm/.circleci/config.yml

Line 270 in 6480176

- image: cimg/rust:1.74.0

[faddat]

@chipshort

Sir, I simply read the Makefile:

wasmvm/Makefile

Line 4 in 0b82922

# This image is currently not published.

[chipshort]

And where do you see that ALPINE_TESTER image being used to build the ".so files in this repository"? That's only used for running tests, as you can clearly see in the Makefile you linked to.