Releases have been altered after publication

[Semnodime]

Expected behavior

Release versions refer to a fixed state, frozen in time.

Actual behavior

The downloadable file refered to by a given version changes in content over time.

Steps to reproduce the behavior

Compare the initial file released as rizin-src-v0.7.2.tar.xz with the one currently accessible.
The hash changed from sha256-/P8/tFrit14/YEvHoIB24yLm4U3veQmBhjeAZcyzWCo= to sha256-6vnkOl2heENHp0ZyTllDj0oWlNyh5ipQCSAJ8BcuH2w=.

Steps to mitigate the behavior

Please release files under a new patch version instead of modifying the published files.

[wargio]

I'm sorry that this happened & I'm investigating on this, but (as you said) this should never happen.

i strongly suspect we re-released v0.7.2 instead of releasing v0.7.3 by mistake.
i will try to find the old images, rebuild them and see if everything matches.

thank you for noticing this.

[Semnodime]

@wargio i will try to find the old images,

FYI, the rizin-src-v0.7.2.tar.xz is cached by cache.nixos.org and can be restored by downloading the .nar.xz and converting it back to the original .tar.xz:
wget -O- https://cache.nixos.org/nar/0qkq1n83pjmyian92yhwcc953fflk16vci2hd9gw0znprjm7gv4r.nar.xz | xz -d | nix-store --restore rizin-src-v0.7.2.tar.xz

[Semnodime]

@wargio Also, v0.7.2.tar.gz apparently has not been altered (for whichever reason) since its publication.

It appears to be identical in contents (besides the subprojects folder) to the initial release of rizin-src-v0.7.2.tar.xz [LINK CONTENT IS THE NEW 0.7.2.tar.xz].

So if you don't have nix-store, you may just inspect the .tar.gz release which differs only in the subprojects folder (see diff.txt).

[wargio]

yes, i'm aware. we noticed that for some reasons by pushing commits on stable, instead of adding the bins to the release on tag it also pushes new bins each time we push commits to the stable branch. this is weird and wrong. we will publish soon v0.7.3 which hopefully will fix this also

[XVilka]

https://github.com/rizinorg/rizin/releases/tag/v0.7.3

But the problem of the release scripts that would update the release if pushed to stable remains. I am not sure how to fix that. I guess it is in the JavaScript code of one of the GitHub Actions we use.

[Semnodime]

1. Is it planned to revert the changes to the release artifacts of v0.7.2?
2. Do current (re-released) artifacts (still) correspond to the source automatically supplied along with it by GitHub?

The answers are important regarding the hash stored in projects like nixpkgs to validate the data supplied for a given version.
See NixOS/nixpkgs#303513 for example.

[wargio]

it's kinda difficult to revert all the release artifacts. since due the xz vulnerability, some sources are not available anymore, thus we cannot just re-run the CI