#: bug "allows arbitrary code to be # into # files without invalidating the signature", "bug has apparently existed since # 1.6 (Donut)", reported to Google in February 2013 cc @question