It started with an attempt to fix a flaky unit test, which expanded into deleting some unused code which expanded into deleting almost 4000 lines of code. A nice PR to finish off with before vacation starts!
Eating one of these is like eating a whole bag of Djungelvrål, it’s completely insane and I can’t stop
(I don’t know how Sparkle operates; if it only does the extraction after signature validation I guess an attack would be pretty hard to pull off even if you have a zero day in the archive decompressor.)
Step 1: find zero day vulnerability in obscure archive format
Step 2: add said archive format to the most popular 3rd party macOS software update framework
Step 3: ???
