Pull Cassandra GPG keys from ASF

docker-library / cassandra

Docker Official Image packaging for Cassandra

Apache License 2.0

262 stars 282 forks source link

Pull Cassandra GPG keys from ASF #237

Closed emerkle826 closed 3 years ago

emerkle826 commented 3 years ago

This should address #236

emerkle826 commented 3 years ago

Closing this in favor of #235

tianon commented 3 years ago

If we download the KEYS file over the internet from the same (potentially hijacked) source where we download the tarballs we are verifying, the verification doesn't add any additional safety, which is why we embed the full cryptographic fingerprints directly in the Dockerfile, allowing the build to verify the provenance of the released artifacts.