phpmyadmin / phpmyadmin/scripts
Add verification for snapshot downloads
Open
@williamdes is already working on this.
Since Nov 10, 2022.
- Dominant language
- PHP
- Stars
- 20
- Forks
- 18
- PR merge metrics
- No merged PRs in 30d
Description
Snapshot downloads from edge-4.7 & edge-4.8 branches are not passed verification (PGP signing with developer keys can't be used as it's auto daily builds...)
possible solutions:
- use bot that update the Dockerfile to contain sha256 verification (the hash inside the Dockerfile) everytime a new snapshot is available. (does it may cause syncing problems? aka old Dockerfile files won't work as the resource URL is static...)
- auto sign the snapshots with bot GPG key (and use it only in keystore)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.