Volumio 3 RC1 - Open Beta Testing

[volumio]

@ashthespy

If you really want to talk about code security, currently there is no guarantee what you upload/download to the new plugin store is actually the code you submit as a merge/pull request over at Pull requests · volumio/volumio-plugins-sources · GitHub

A bad actor could easily open a PR to github with “good” code while submitting a plugin to the store with modified code that contains malware. Earlier, this wouldn’t be so straightforward, as the volumio-plugins repo was the single source of truth - the code you saw there was what was getting packaged by the Volumio devs, and finally downloaded…

Really good point. As of now the procedure we’ve set in place should not allow this to happen, but we shall for sure harden in and make sure there is a 1:1 correspondence with what has been published on the sources repo.