Getting a validation warning for markdeep script
Open
cleanup
- Dominant language
- Haskell
- Stars
- 1.3k
- Forks
- 201
- PR merge metrics
- No merged PRs in 30d
Description
```
./casual-effects.com/markdeep/latest/markdeep.min.js: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
DANGER: Validation failed for downloaded third-party code; tampered with?
```
It looks like this pulls the latest version, and validates against a checksum, so it will start failing any time a new markdeep is released. We should either pin the version, or stop validating the checksum. Pinning the version is the safer choice, but I suddenly realize this is volunteering me for a pretty tedious job constantly trying to stay up to date with security bugs and such in downstream libraries. That sucks.
Contributor guide
Assessment
This issue has not been assessed yet.