ruby / ruby/rubygems

Please provide SHA256 (or equivalent) checksums for releases

Open
#2,656 9 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: feature request
Dominant language
Ruby
Stars
4k
Forks
1.9k
Avg merge
1d 2h
Merged PRs (30d)
81

Description

Hi,

Could you please provide checksums for releases? We think https://github.com/rubygems/rubygems/issues/939 still is relevant as by today, because even if the downloads happens via https, we have no way to check if we had a corrupted file in the end.

In our case, we need that because we verify that we have a consistent download inside our build infrastructure. I'm aware that gemfiles can be checked via API
e.g. curl https://rubygems.org/api/v2/rubygems/rubygems-update/versions/3.0.2.json |jq .sha -r. Also, we store those checksums in manifests files that other users are consuming and we use that to automatically verify the package integrity.

But this unfortunately doesn't applies to tgz releases of rubygems itself that can be downloaded from the website, because the content from the gem differs.

cc: @dragonchaser
Thank you

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the release downloads linked from rubygems.org/pages/download and review how the tgz releases are currently published. Determine where release checksums would be generated and exposed, then verify that the published values match the downloadable archives.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
release
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.