Verify checksum of downloaded version archive

actions / setup-python

Set up your GitHub Actions workflow with a specific version of Python

MIT License

1.59k stars 505 forks source link

Verify checksum of downloaded version archive #889

Open firewave opened 2 weeks ago

firewave commented 2 weeks ago

Description: After the download of the version archive it should verify the checksum of the file against the provided hashes.sha256 for the release in question.

Justification: This ensures that the downloaded file is the actually intended one.

Are you willing to submit a PR?

aparnajyothi-y commented 2 weeks ago

Hello @firewave, Thank you for creating this issue and we will get back to you once we have some feedback on this :)