Check for tampering in CSQLite sources

This script tries to ensure that CSQLite does not tamper with their SQLite
sources.

For each file in the repo, we determine whether it came from upstream SQLite or
was added specifically for the package. We compare files from upstream with
upstream's SQLite sources. For files that originate from CSQLite itself, we
compare to the last known good commit, which received a full review.

Our old clemensg/sqlite3pod CocoaPods dependency was a source package, which
merely downloaded the sources from upstream and unpacked them itself. This gave
more assurance that we were receiving actual upstream sources, with
minimal/auditable packaging code. Since SwiftPM doesn't allow connection to the
internet while sandboxed, this source package approach isn't as easy in the
SwiftPM world; the relevant sources are vendored in the package.

As we continue to bump the dependency, we want to ensure that nothing has been
added in these intermediate vendored files. The script is slightly hacky at the
moment, but can be improved as time goes on.

0 files changed, 0 insertions, 0 deletions