docker / docker/docker-credential-helpers
Sign releases, use correct file formats
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 195
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 5
Description
Currently, I can't find any public signatures (or at least file integrity checksums) for release files.
In 2018... C'mon guys!
Even the Docker docs link here as the official release source, do you expect users to just throw random binaries from github onto their systems to handle login credentials?
Please use some form of signature to provide trust as well as file integrity.
Another issue I noticed with releases: The Linux tarball for v0.6.0 is not gzipped, although it has the ".gz" file extension.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how release files are produced and published, using the v0.6.0 Linux tarball and the Docker documentation link as the concrete references mentioned. Determine how public signatures or integrity checksums should accompany release files and verify that the Linux tarball content matches its .gz extension. Done means users can verify release artifacts and the format mismatch is corrected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go, linux
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100