chocolatey / chocolatey/choco

Require checksums for HTTPS resources

Open
#895 11 comments 2 reactions 0 assignees View on GitHub
0 - Backlog Enhancement Priority - High Requires Upstream Change Security
Dominant language
C#
Stars
11.5k
Forks
960
PR merge metrics
No merged PRs in 30d

Description

With #112, we started requiring checksums for HTTP/FTP and provided an enabled feature to require checksums for HTTPS as well. If a checksum is missing in these scenarios, it would fail the package.

This switches the feature `allowEmptyChecksumsSecure` to disabled.

Contributor guide

Open the contributing guide

Research direction

Locate the handling of the allowEmptyChecksumsSecure feature and read the surrounding checksum validation logic. Run the relevant existing package or checksum tests, if present, and confirm that HTTPS resources without checksums now fail while resources with checksums continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.