^{Originally posted by ascopes December 10, 2024}

Brief description

Be able to provide an optional SHA1/MD5/SHA256 digests in binaryUrlPlugins.

Aims and goals

Improve the stance on security to allow users to detect if their dependencies have changed without them realising.

Workarounds

Store the artifacts in a well-known and trusted registry.

In scope

• Digests for URL plugins.
• Digests for protoc when provided as a URL.

Out of scope

• Digital signature detection and verification across various binary formats.
• GPG verification (this needs more research and should be implemented separately in the future if requested).