Not sure where/how to raise this/nor if its urgent - but if we now need sha1 for bosh-init manifests perhaps concourse's bosh-io-release resource needs to be able to fetch the sha1.
Or if we trust bosh-io-release to download the right tgz do we not need to worry about sha1 verification.
I'll admit to getting confused on the topic of if/when to do download verification; and how to ensure its not hacked as well.
Not sure where/how to raise this/nor if its urgent - but if we now need sha1 for bosh-init manifests perhaps concourse's
bosh-io-releaseresource needs to be able to fetch the sha1.Or if we trust bosh-io-release to download the right tgz do we not need to worry about sha1 verification.
I'll admit to getting confused on the topic of if/when to do download verification; and how to ensure its not hacked as well.