Which checks the downloaded package against the computed SHA256 of the file. While limited, it aims to provide some reproducible builds.
However, with the introduction of multiple platforms (and the detection, not showing in the snippet), will be better to download the SHA256 of each binary to validate its integrity.
Request:
Will be possible to publish a .sha256sum along each of the packages? (Eg. overmind-v2.2.1-linux-amd64.gz.sha256sum) Or just one for all files in the same release?
Thank you in advance and once again, thank you for creating and sharing Overmind and Hivemind with the world! ❤️ ❤️ ❤️
Hello folks,
Thanks for creating and releasing both overmind and hivemind, these have become the first tool in my toolbelt for development! 😍
Background:
Until recently I've been using only with linux/amd64 binaries with Docker, but more and more, linux/arm64 (aarch64) is becoming popular.
In order to ensure integrity of overmind/hivemind installation, I've been using the following approach in my Dockerfiles:
Which checks the downloaded package against the computed SHA256 of the file. While limited, it aims to provide some reproducible builds.
However, with the introduction of multiple platforms (and the detection, not showing in the snippet), will be better to download the SHA256 of each binary to validate its integrity.
Request:
Will be possible to publish a
.sha256sum
along each of the packages? (Eg.overmind-v2.2.1-linux-amd64.gz.sha256sum
) Or just one for all files in the same release?Thank you in advance and once again, thank you for creating and sharing Overmind and Hivemind with the world! ❤️ ❤️ ❤️
Cheers.