opensearch-project / opensearch-project/data-prepper
Verify the SHA-256 for downloaded MaxMind databases
Open
@dlvenable is already working on this.
Since Mar 21, 2024.
enhancement
- Dominant language
- Java
- Stars
- 374
- Forks
- 354
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 8
Description
Is your feature request related to a problem? Please describe.
The GeoIP database manifest contains a sha256_hash value. Data Prepper should verify this against the data downloaded to enhance security.
Describe the solution you'd like
After downloading a database from the URL provided by a manifest.json, calculate the SHA-256 of the download. After that, verify it matches the expectation. If not, do not use the database.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.