WebAssembly / WebAssembly/binaryen
Start publishing signature files for binaryen artifacts
Nobody has claimed this yet.
- Dominant language
- WebAssembly
- Stars
- 8.6k
- Forks
- 885
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 69
Description
Request
Start publishing armored signature files for binaryen artifacts. E.g. for binaryen-version_118-aarch64-linux.tar.gz add binaryen-version_118-aarch64-linux.tar.gz.asc file so that the origin of this artchives can be validated.
Reasoning
Today releases for binaryen ship as tar.gz archives (e.g. binaryen-version_118-aarch64-linux.tar.gz). Kotlin Gradle Plugin uses binaryen for javascript multiplatform targets. It fetches these files from https://github.com/WebAssembly/binaryen/releases/download. Sadly, users that use Gradle signature verification have to allowlist binaryen artifacts because they are missing .asc signature files. Validating signatures allow consumers of binaryen to know they are getting artifacts from an expected source.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how binaryen release tar.gz archives are produced and uploaded. Determine where armored signatures could be generated and attached as .asc assets, then verify a release contains matching signature files that consumers can validate. The issue names no specific files or tests, so the release tooling and signing process will need to be located first.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- wasm
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100