Please provide SHA256 (or equivalent) checksums for releases
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 4k
- Forks
- 1.9k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 81
Description
Hi,
Could you please provide checksums for releases? We think https://github.com/rubygems/rubygems/issues/939 still is relevant as by today, because even if the downloads happens via https, we have no way to check if we had a corrupted file in the end.
In our case, we need that because we verify that we have a consistent download inside our build infrastructure. I'm aware that gemfiles can be checked via API
e.g. curl https://rubygems.org/api/v2/rubygems/rubygems-update/versions/3.0.2.json |jq .sha -r. Also, we store those checksums in manifests files that other users are consuming and we use that to automatically verify the package integrity.
But this unfortunately doesn't applies to tgz releases of rubygems itself that can be downloaded from the website, because the content from the gem differs.
cc: @dragonchaser
Thank you
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the release downloads linked from rubygems.org/pages/download and review how the tgz releases are currently published. Determine where release checksums would be generated and exposed, then verify that the published values match the downloadable archives.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- release
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100