[RFC] Improve binary security

Since I haven’t received any negative feedback on the latest comment I will assume that we have reached consensus to:

  • Only allowed the release managers to upload release assets. They will be signed and a github workflow will be created to remove any unsigned upload to a release.
  • We will work towards having automated builds via GitHub actions.
  • Third party binaries will no longer be hosted by any LLVM site.

This will be implemented for LLVM 19 release.

Thanks to everyone that have commented and gave their feedback on this.

– Tobias

5 Likes