Require checksums for HTTPS resources
Open
0 - Backlog
Enhancement
Priority - High
Requires Upstream Change
Security
- Dominant language
- C#
- Stars
- 11.5k
- Forks
- 960
- PR merge metrics
- No merged PRs in 30d
Description
With #112, we started requiring checksums for HTTP/FTP and provided an enabled feature to require checksums for HTTPS as well. If a checksum is missing in these scenarios, it would fail the package.
This switches the feature `allowEmptyChecksumsSecure` to disabled.
Contributor guide
Research direction
Locate the handling of the allowEmptyChecksumsSecure feature and read the surrounding checksum validation logic. Run the relevant existing package or checksum tests, if present, and confirm that HTTPS resources without checksums now fail while resources with checksums continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100