runfinch / finch

The Finch CLI is an open source client for container development
https://www.runfinch.com
Apache License 2.0
3.47k stars 87 forks source link

fix: verify shasum for finch dependencies #969

Closed austinvazquez closed 1 day ago

austinvazquez commented 3 weeks ago

Issue #, if available: Finch dependencies must be verified against known good shasum at pull time.

Description of changes: This change refactors Finch to use the dependency mechanism in finch-core for pulling and verifying core dependencies such as the OS image and Lima bundle for macOS and the rootfs archive for Windows platforms.

As a side effect of this change, dependency updates are now 1-to-1 with finch-core updates. This is a simplification on the current mechanism which duplicated the effort for updates.

Testing done: Ran make on macOS.

License Acceptance

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.