Feature Request : allow legacy uploaders
earonesty opened this issue · 1 comments
I'm 100% sure that this giant binary is a lot easer to hack than the old uploader.
The main issue was simply not signing it
If codecov had simply signed their existing uploader - and made it hard to download without verification, it would have been every bit as secure as the new 40mb executable that a MITM can zero-day your whole machine with.
@earonesty although the move to the current uploader and CLI was in part a response to the security incident, one of the other major components was that the various unloaders were too difficult to maintain by the team. The legacy uploaders were built in languages that weren't native to the team's expertise, and thus, building new features and patching security bugs was problematic.
Currently, it is still possible to use them to upload to Codecov, although we expect the actual serving of the legacy uploaders to be removed in time.