Need supply chain security for jfrog-cli direct downloads (e.g. via curl)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 595
- Forks
- 307
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 17
Description
Is your feature request related to a problem? Please describe.
We need to be certain the jfrog-cli executable is free of supply chain attacks. While we are aware there are ways to do this with package manager approaches (apt-get, dnf), there also needs to be a way to validate authenticity of the jfrog-cli binary when it is downloaded via curl. This could be done by offering .sig files for the binaries, or by using cosign. In fact, jfrog seems to have a system for this for many of their binaries, but not for the jfrog-cli?
Describe the solution you'd like to see
.sig files for gpg verification of the curl downloaded jfrog-cli binaries, or sign using cosign.
Describe alternatives you've considered
We are aware checking sha256 is possible, but that is subject to trust on first use attacks (the sha256 might have been modified in addition to the binary.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing how jfrog-cli binaries for direct curl downloads are built and published, including the existing checksum distribution. Choose and document a verification approach using .sig files or cosign, then confirm that users can verify the authenticity of each downloaded binary independently of its checksum.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- release, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100