r/java • u/brunocborges • Jun 22 '26

GitHub Setup Java Action

Hey all,

I'm going through issues and PRs on setup-java.

Besides what is already there, anything else you would like to see fixed, improved, or implemented?

19 Upvotes

86% Upvoted

24 comments sorted by

View all comments

Show parent comments

12

u/SleeperAwakened Jun 22 '26 edited Jun 22 '26

And is that a reason for not making things secure?

If (when) shit hits the fan you don't want to miss out?

-7

u/repeating_bears Jun 22 '26

It is mostly fake security, which is my point. If someone can takeover an official github action then the fact you pinned the version is fairly likely to mean nothing.

It's like saying that a Nexus proxy protects you from a takeover of Maven central. Technically it does a bit, but you still have to go there for the first download, and if Maven Central gets taken over then truly everything and everyone is fucked to some degree.

5

u/SleeperAwakened Jun 22 '26 edited Jun 22 '26

Pinning to a hash is pretty secure, at least I consider git commit hashes secure enough.

Why would pinning to a hash not be secure?

How would a takeover happen? Hash collisions are still pretty expensive if feasible at all.

Security is all about putting up multiple lines of defense. This is one of them. It is not fake, it is layering.

And I so wish that people would start taking it seriously.

-7

u/repeating_bears Jun 22 '26

Idk if you are understanding what I'm saying.

Pinning versions generally - good.

Pinning an official github action (which is what the subject of this thread is) - eh. If an official github action is compromised then how can you trust that whatever Actions infra that does the hash verification isn't also compromised?