Sign releases (gpg)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
The payload names no source files or tests; the work sits in the release process, not the Python code. Start by finding how the GitHub releases page and its artifacts are produced in the repository's release workflow or docs, and confirm whether a signing key already exists. Done means releases ship with a published GPG key, a signature or SHA256SUMS.asc file, and a docs page linked from the downloads page. Key custody needs maintainer input before any change.
由索引模型根据 Issue 内容生成。
描述
Currently it is not possible to verify the authenticity or cryptographic integrity of the downoads from github.com because the releases are not cryptographically signed.
This makes it hard for your users to safely obtain the b2 software, and it introduces them (and potentially their servers) to watering hole attacks.
Steps to Reproduce
- Go to the releases page https://github.com/Backblaze/B2_Command_Line_Tool/releases
- Click download
- ???
Expected behavior: [What you expected to happen]
A few things are expected:
- I should be able to download the Backblaze release signing PGP key out-of-band from popular third-party keyservers (eg https://keys.openpgp.org/)
- I should be able to download a cryptographic signature of the release (or, better, the releases' digest file, such as a
SHA256SUMS.ascfile) along with the release itself - The downloads page itself should include a link to the documentation page that describes how to do the above two steps
Actual behavior: [What actually happened]
There's just literally no information on verifying downloads, and it appears that it is not possible to do so.
- 主要语言
- Python
- 星标
- 638
- 派生
- 138
- 平均合并
- 8 小时 27 分钟
- 30 天内合并 PR
- 8
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
Backblaze/B2_Command_Line_Tool 的其他 Issue
-
enhancement
难度 2/5 1-3 小时 新手友好度 62/100
Backblaze/B2_Command_Line_Tool#553 · 2 条评论 · 3 个 reaction ·
维护者通常 1 天内回复
-
Adopt the AI-native SDLC playbook and repository policies可能已有人在做 @goanpeca 于 18 天前认领。 未关闭enhancement
难度 5/5 一周以上 新手友好度 25/100
Backblaze/B2_Command_Line_Tool#1192 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 25/100
Backblaze/B2_Command_Line_Tool#1168 ·
维护者通常 1 天内回复
-
Add to MacPorts未关闭
难度 3/5 1-2 天 新手友好度 50/100
Backblaze/B2_Command_Line_Tool#1161 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 56/100
Backblaze/B2_Command_Line_Tool#1155 ·
维护者通常 1 天内回复
查看 Backblaze/B2_Command_Line_Tool 的全部 Issue
相似的 Issue
-
ライブラリを追加未关闭priority middle
难度 1/5 1 小时以内 新手友好度 62/100
KATO-Hiro/AtCoderClans#13015 ·
维护者通常 1 天内回复
-
StringLiteral to IntegerType/LongType silently truncates fractional strings, changing predicate meaning可能已有人在做 @Shahzeb-DataEngineer 今天认领。 未关闭kind:bug
难度 2/5 1-3 小时 新手友好度 68/100
apache/iceberg-python#4382 · 2 条评论 ·
维护者通常 1 天内回复
-
request-theme
难度 2/5 1 小时以内 新手友好度 62/100
LizardByte/ThemerrDB#10024 · 2 条评论 ·
-
难度 1/5 1 小时以内 新手友好度 72/100
btclib-org/btclib-node#2505 · 1 条评论 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 78/100
open-webui/open-webui#34462 · 1 条评论 ·
维护者通常 1 天内回复