janhoy commented on code in PR #4336: URL: https://github.com/apache/solr/pull/4336#discussion_r3158058747
########## solr/core/src/test/org/apache/solr/util/FileTypeMagicUtilTest.java: ########## Review Comment: Problem with real binary files in git, is that it is an anti-pattern. We should not have a single binary file in the repo which cannot be reproduced from source or from a script of some kind. Else we risk supply chain attachs with a contributor adding some nice-looking binary in a PR and we merge it without checking what it hides. Perhaps there exists some catalog of well-known binary files with known SHA-512 hashes that we could use for this purpose? Or am I being too cautious? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
