ConduitIO / ConduitIO/conduit

Feature: Hash sum validation for connectors

Open
#586 1 comment 0 reactions 0 assignees View on GitHub
feature
Dominant language
Go
Stars
610
Forks
63
Avg merge
12h 28m
Merged PRs (30d)
57

Description

### Feature description

Conduit connectors are go-plugin clients, and go-plugin supports hash sum validations for those:

> // SecureConfig is used to configure a client to verify the integrity of an
// executable before running. It does this by verifying the checksum is
// expected. Hash is used to specify the hashing method to use when checksumming
// the file. The configuration is verified by the client by calling the
// SecureConfig.Check() function.
//
// The host process should ensure the checksum was provided by a trusted and
// authoritative source. The binary should be installed in such a way that it
// can not be modified by an unauthorized user between the time of this check
// and the time of execution.

Source: https://github.com/hashicorp/go-plugin/blob/master/client.go#L230-L239

This can be used to increase a Conduit operator's confidence that the plugins used haven't been tampered with.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.