help wantedkind/enhancement
仓库指标
- 星标
- (64,042 个星标)
- PR 合并指标
- (平均合并 11天 5小时) (30 天内合并 118 个 PR)
描述
Proposal
Use case. Why is this important? Currently the Makefile pipes a download from curl directly to tar without verifying checksums.
This makes the build vulnerable to man in the middle attacks, and prevents the build from being reproducible.
Verifying checksums will fix the security vulnerability. Additionally verifying checksums makes builds reproducible and cachable.