Authentication of Release

[ClashTheBunny]

Hi,

I'm using MDL in a project and am packaging it for cljsjs. A MD5 checksum is used for validation. Is there a way that you could publish a checksum over a secure channel?

It would also be nice, for projects more interested in security than cljsjs, to have PGP signed releases.

At minimum, could I get confirmation that 1.0.4 has an MD5 checksum of e6883041f5cf44642b1539ecf5a25f9c?

Thanks!
Randall Mason

[surma]

Adding a checksum to the download sounds like a good idea to me.

And I can provide the following checksums for MDL’s 1.0.4 ZIP file

• MD5 e6883041f5cf44642b1539ecf5a25f9c
• SHA1 0763907621123b1b05e2c323e83e1dd5957a9e1d
• SHA256 03a5b2acb124bc7d389943ce8c9835e60cdad33643d949d337516da8ceb0649a

[surma]

We have decided to provide these checksums on the GitHub release notes in the future.

[sgomes]

FYI, we started including these in our release notes, starting with 1.0.5 today!