aws / aws/aws-cli

Publish sha512 checksums of published artifacts

Open
#7,908 2 comments 9 reactions 0 assignees View on GitHub
feature-request installation p2
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the feature

For the artifacts published on https://awscli.amazonaws.com/ and referenced in the install documentation https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html it would be nice to have sha256 checksums that can be downloaded to check the integrity of the artifacts. This is complementary to the GPG checks that is encouraged as in some contexts it is simpler to check a sha256 fingerprint than a GPG signature.

### Use Case

The context is for "distributions" or "installers" of awscli, such as asdf that can be improved by adding additional checks (important in contexts where SSL can't be trusted) see https://github.com/asdf-vm/asdf/issues/1320 and for awscli specifically https://github.com/MetricMike/asdf-awscli/issues/28

### Proposed Solution

The signatures should be generated by the infrastructure generating the distribution of awscli, and probably published as separate files and maybe also published on github for cross reference.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CLI version used

1.27.139

### Environment details (OS name and version, etc.)

Ubunutu

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.