search

mvdan / sh

A shell parser, formatter, and interpreter with bash support; includes shfmt
https://pkg.go.dev/mvdan.cc/sh/v3
BSD 3-Clause "New" or "Revised" License
7.1k stars 336 forks source link

SHA-256 checksums file for each new release #901

Closed bryanburke closed 1 year ago

bryanburke commented 2 years ago

Only similar issue I could find is #394, but that issue was closed a while back due to lack of OP reply.

I believe a file of release binary SHA-256 checksums (e.g., as generated by sha256sum) included in each new GitHub release would be helpful for automation.

For example, when pinning and installing a specific version of shfmt via a script in a CI pipeline, the DevOps engineer must currently pre-download the binary, calculate the checksum, and store it in the script or an env var. Ideally, the engineer could provide only the desired version to the script, which could then compare the downloaded binary against the published release checksum as a basic form of integrity checking.

Note that I am not asking the project to retrofit previous releases with checksums, only add them to future releases.

Thanks for your time and this incredible tool!

mvdan commented 2 years ago

Sure. Is there a standard way to do this with GitHub releases? As part of the release description, as extra downloads containing only the hash string, or perhaps as part of each filename like shfmt_v3.5.1_linux_amd64_hexhash?

bryanburke commented 2 years ago

The two most typical approaches I have seen are the following:

  1. A single text file as an additional release artifact (usually named checksums.txt, sha256sum.txt, etc.) with one checksum per line.

  2. One text file per binary as additional release artifacts (usually named NAME_OF_BINARY.sha2, NAME_OF_BINARY.sha256, etc.) with only the checksum digest in each file.

GoReleaser uses the first approach, for example: https://goreleaser.com/customization/checksum/

mvdan commented 1 year ago

Done; see https://github.com/mvdan/sh/releases/tag/v3.6.0. This is now part of my release build script, so it will be included in future releases.