ChainSafe / ChainSafe/lodestar
Verify checksum of downloaded spec tests tarball
Open
scope-security
- Dominant language
- TypeScript
- Stars
- 1.4k
- Forks
- 483
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 150
Description
We should check the integrity of the downloaded spec tests before unpacking the tarball. This would require us to specify the expected checksum when we bump the spec version but this seems like a minor effort.
Contributor guide
Research direction
Locate the code and configuration that download and unpack the spec tests tarball, along with where the spec version is bumped. Start there to determine how the expected checksum can be supplied and verified before extraction; done means a mismatched tarball is rejected and the expected checksum is updated with the spec version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security, testing-qa
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100