Consider providing checksums for the release files

[rolinh]

Request Type

Feature Request

Problem Description

The release files (binary/zip/deb/rpm) are currently uploaded to bintray. No file checksum is provided so there are no way for users to verify the integrity of the files.

Possible Solutions

Upload a SHA256 (or other popular secure hash) sum of each file along with them.
Bonus: sign the files (eg with PGP) so that their authenticity can be validated as well. I believe this is important considering the binaries are deployed on production systems by users.

[saadkadhi]

@rolinh we already provide PGP-signed RPMs and DEBs but we should definitely extend that to bin packages and possibly add SHA256 sums if lazy folks don't want to put up with the PGP PITA. I've created an issue for that in the Cortex repo as well (TheHive-Project/Cortex#105).

❯ gpg --verify TheHive_3.0.9-1_all.deb.asc TheHive_3.0.9-1_all.deb
gpg: Signature made Fri Apr 13 15:22:43 2018 CEST
gpg:                using RSA key 3D99BB18562CBC1C
[...]
gpg: Good signature from "TheHive Project (TheHive release key) <support@thehive-project.org>" [full]

[saadkadhi]

The pubkey is located at https://github.com/TheHive-Project/TheHive/blob/master/PGP-PUBLIC-KEY.

[To-om]

It will be done in the new repository (cf. #618)