Download URLs for opentelemetry artifacts with scarf.sh - Githubissues

open-telemetry / sig-security

Apache License 2.0

7 stars 8 forks source link

Download URLs for opentelemetry artifacts with scarf.sh #46

Open svrnm opened 3 months ago

svrnm commented 3 months ago

See https://github.com/open-telemetry/community/issues/1993 for the details.

Before rolling this out, we need to make sure that we understand the security implications of using such a solution.

A few notes:

scarf is not hosting the artifacts, they provide a redirect.
We can point to their server via a CNAME (get.opentelemetry.io) and remove that pointer if needed

I created a prototype at get.opentelemetry.io/0.95.0/darwin/arm64/ocb so you can create a test request to see how the flow works (basically https://get.opentelemetry.io/0.95.0/darwin/arm64/ocb sends a 302 with location https://github.com/open-telemetry/opentelemetry-collector/releases/download/cmd%2Fbuilder%2Fv0.95.0/ocb_0.95.0_darwin_arm64)