Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add verification for snapshot downloads #50

Open
emanuelb opened this issue Jun 29, 2017 · 2 comments
Open

Add verification for snapshot downloads #50

emanuelb opened this issue Jun 29, 2017 · 2 comments
Assignees
@williamdes

Comments

@emanuelb
Copy link

Snapshot downloads from edge-4.7 & edge-4.8 branches are not passed verification (PGP signing with developer keys can't be used as it's auto daily builds...)
possible solutions:

  1. use bot that update the Dockerfile to contain sha256 verification (the hash inside the Dockerfile) everytime a new snapshot is available. (does it may cause syncing problems? aka old Dockerfile files won't work as the resource URL is static...)
  2. auto sign the snapshots with bot GPG key (and use it only in keystore)
ibennetch referenced this issue in phpmyadmin/docker Jun 8, 2019
@ibennetch
Remove GPG verification of downloads, since we don't sign snapshot
21be77a 
builds.

See also: #131

Fixes: #228

Signed-off-by: Isaac Bennetch <[email protected]>
@williamdes
Copy link
Member

As far as I know edge- branches are no more supported

@williamdes williamdes self-assigned this Nov 10, 2022
@williamdes williamdes transferred this issue from phpmyadmin/docker Nov 10, 2022
@williamdes
Copy link
Member

Moved here, as we should GPG sign snapshots as I said in #39

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@williamdes williamdes

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@emanuelb @williamdes