clojure-tools artifacts are published unauthenticated, which is a security risk, especially for the linux install.
One simple approach would be to output a checksum file and sign the checksum file. I recommend not signing with openssl or pgp, and deferring to a simple tool like signify.
Environment
None
Activity
Show:
Alex MillerJune 25, 2021 at 8:34 PM
The linux script and tar.gz is downloaded via https (and have been as long as I can remember).
It would be useful to provide checksum or signature, but moving this to backlog for now.
clojure-tools artifacts are published unauthenticated, which is a security risk, especially for the linux install.
One simple approach would be to output a checksum file and sign the checksum file. I recommend not signing with openssl or pgp, and deferring to a simple tool like signify.