On Sun, Oct 25, 2020 at 4:31 PM Punk-BatSoup-Stasi 2.0 <punks@tfwno.gf> wrote:
On Sun, 25 Oct 2020 15:52:25 -0400 Karl <gmkarl@gmail.com> wrote:
As punk half-asserts, signed tarballs (which have source code but not history) are still available at https://yt-dl.org/download.html
yeah I assumed the tar.gz file has the source, but I just noticed that its size is 1.5 megs - it used to be 3.something megs. I have a youtube-dl-2019.12.25.tar.gz file that is 3.2 megs. I stupidly didn't keep anything newer than that.
which is a blessing, although it seems there are even better solutions kicking around.
Yeah, when I try to actually download the 1.5 meg tarball, I get an error about an expired SSL certificate, and after download via that expired certificate it has an sha256sum that doesn't match the one on the website, if it matters. Lots of python files, though. Icing on the cake, the signature doesn't verify! That's always exciting. $ sha256sum youtube-dl-2020.09.20.tar.gz* ead79e9248aaf7667f015da2ccd4bde44a8948fa980f82965609cdca88ad285e youtube-dl-2020.09.20.tar.gz ab15f22cb3f9b22ef2c853e0326319bcfcf9fb92e7de6f2a9520c7c4ae6e23a4 youtube-dl-2020.09.20.tar.gz.sig $ gpg --verify youtube-dl-2020.09.20.tar.gz.sig gpg: Signature made Sun 20 Sep 2020 01:32:08 AM EDT using RSA key ID 18A9236D gpg: BAD signature from "Sergey M. <dstftw@gmail.com>" $ wc -c youtube-dl-2020.09.20.tar.gz* 1481717 youtube-dl-2020.09.20.tar.gz 566 youtube-dl-2020.09.20.tar.gz.sig 1482283 total My email to you doesn't even have a signature, so it has likely changed too.