mirror of
https://github.com/sbt/sbt.git
synced 2026-09-03 16:39:24 +02:00
Blobs pulled from a gRPC remote cache were written to the CAS and synced into the build without re-hashing, so a compromised cache server or plaintext MITM could substitute bytes under the requested digest. Re-hash remote blobs on write and reject on mismatch, and warn when a plaintext grpc:// endpoint is configured.