Change #271228

Comments

verify-release: don't unpack in git repo
- Clarify that the tarball to verify should be put in the same dir you
  run the script.

- Verify that the curl version number in the file name matches the
  version number within the tarball. To reduce risk for mistakes.

- When verifying using git, do not unpack the tarball. It avoids the
  security risk with malicious tarball contents playing tricks on git.

- Only unpack the tarball for git-less verfication.

- Move the source tarball into _tarballs/ instead of overwriting it,
  which can be useful in case the verification fails

Closes #22032

Changed files

• scripts/verify-release