Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
Suspicious data sources during build #774
Comments
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment Hide comment
thestinger
Oct 19, 2017
Contributor
android-prepare-vendor isn't Copperhead software:
https://github.com/anestisb/android-prepare-vendor
The sha256sum of the oatdump download is verified so I don't see this as an issue.
|
android-prepare-vendor isn't Copperhead software: https://github.com/anestisb/android-prepare-vendor The sha256sum of the oatdump download is verified so I don't see this as an issue. |
thestinger
closed this
Oct 19, 2017
thestinger
added
the
Type: question
label
Oct 19, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
EnSec4Git commentedOct 19, 2017
•
edited
Edited 1 time
-
EnSec4Git
edited Oct 19, 2017
Hi,
While performing the "Extracting vendor files for Nexus and Pixel devices" step during build, in particular in the
vendor/android-prepare-vendor/execute-all.sh -d $DEVICE -b $GSBUILD_ID -o vendor/android-prepare-vendor, the script downloads theoatdumptool from pretty weird URLs, including (for me at least):Both of these appear to be outside of Copperhead's control.
Can you clarify are there any legal reasons for not hosting the required files in GitHub or somewhere else?