Trust?

[fun29]

How do we know this repo and the releases can be trusted and that it is not compromised after all the messages we have seen about github being compromised and the illegal untracable commits that have been done by threat actors?

[Raphire]

Heya,

The latest github situation was definitely concerning, but as far as I know that was limited to github's own internal repositories being leaked. It didn't involve code getting modified secretly. Something like that would be quite hard to do as the git history would need to be changed, and that's something that would be noticed quite quickly.

To secure things on my end I do everything to secure my accounts. I also sign my commits so you can verify that they're from me. You'll see a verified badge next to those. Although I did miss a few commits a couple of weeks ago after I forgot to setup commit signing on my new machine. When looking at releases, you can see the last commit id with a verified badge if it's signed:

If you want to reduce the risk of potential issues, I suggest downloading the source code from a release directly, instead of using the launch command. I have documented instructions here: https://github.com/Raphire/Win11Debloat/wiki/How-To-Use#traditional-method