search

silverstripe / sspak

Tool for managing bundles of db/assets from Silverstripe environments
http://silverstripe.github.io/sspak/
BSD 3-Clause "New" or "Revised" License
47 stars 34 forks source link

Validate the SHA256 of the SSPAK file #60

Closed Firesphere closed 6 years ago

Firesphere commented 6 years ago

The installer is blindly trusting the SSPAK to be the real deal. verifying the SHA against the known value of what it should be is safer.

dhensby commented 6 years ago

hmm - the sha needs to be updated whenever a new build is published (which is done automatically via travis) so this needs to be part of the phar build process

dhensby commented 6 years ago

I'm closing this as stale - we can now push users to install via composer rather than via bash