Verify SHA256 checksum of downloaded file #63
Conversation
|
We ask that commits include a developer certificate of origin (DCO), which means a Signed-off-by line indicating someone who asserts that the code in the commit is acceptable for the open source license. That can be added to an existing PR by using:
|
devurandom
force-pushed
the
ds/verify-download
branch
from
6993c8d
to
c106276
Compare
devurandom
changed the title
Signed-off-by: Dennis Schridde <dennis@metabase.com>
…cksum form the internet if not provided
devurandom
force-pushed
the
ds/verify-download
branch
from
c106276
to
c7bfa08
Compare
devurandom
changed the title
There was a problem hiding this comment.
Looks like all of the feedback has been incorporated, and I really like where this ended up. @DentonGentry are you okay with this? (This would be the last PR I would want to get in before tagging a v2)
|
(interesting... I've never resolved a merge conflict through the GitHub UI before. I'll squash all this down on final merge) |
|
I had missed that it fetches the sha256 from pkgs.tailscale.com if not specified explicitly, that was my last objection. We can get this in, tag v2, and publish the Changelog. |
Verify the binary downloaded before unpacking or executing it, to enhance security. Opt-in by providing the
sha256sumargument.Signed-off-by: Dennis Schridde dennis@metabase.com