influxdata / influxdata/docs-v2

Getting started guide for InfluxDB 3 Core and Enterprise lacks sha256 of the install script

Open
#5,764 1 comment 0 reactions 0 assignees View on GitHub
security security/misc
Dominant language
JavaScript
Stars
82
Forks
326
Avg merge
1d 1h
Merged PRs (30d)
82

Description

While convenient, `curl | sh` is not best practice (even when served over HTTPS; consider the `codecov` incident). At a minimum, please add the sha256sum for the install script in these sections. You could alternatively update the command to verify the sha256sum as part of the invocation (similar to how telegraf (et al) verify the gpg key in https://www.influxdata.com/downloads/).

Note: the install script correctly verifies the sha256 of the file it downloads. This is about ensuring that the sha256 of the install script itself can be verified.

##### Relevant URLs
- https://docs.influxdata.com/influxdb3/core/get-started/#run-the-install-script
- https://docs.influxdata.com/influxdb3/enterprise/get-started/#run-the-install-script

Contributor guide

No contributing guide indexed for this repository

Research direction

Open the linked InfluxDB 3 Core and Enterprise getting-started pages and inspect their “Run the install script” sections. Add the install script’s sha256sum or an invocation that verifies it before execution, then confirm both sections provide a usable verification step.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.