search

zonkyio / embedded-postgres-binaries

Lightweight bundles of PostgreSQL binaries with reduced size intended for testing purposes.
Apache License 2.0
153 stars 32 forks source link

Add a security section to the Readme #81

Open alexanderkjeldaas opened 5 months ago

alexanderkjeldaas commented 5 months ago

This project is used by lots of other projects it seems, but it is entirely unclear to me what the security assumptions for downloading these postgres binaries are.

Is it possible to have a checksum on a specific downloaded artifact or is this published somewhere, and what is the best practice to protect against supply chain attacks when using these builds?

A section in the README discussing these points would be great.

tomix26 commented 4 months ago

Thanks for your question about the security of downloading Postgres binaries.

The binaries are available as Maven packages through the Maven Central repository, where all artifacts are digitally signed to ensure their integrity and authenticity.

You can also check the source code and build scripts in the repository to see exactly how the binaries are created. This should give you peace of mind, knowing you can verify the entire process.

If you still have concerns, you can always build the binaries yourself from the source files. This way, you have full control and can ensure everything is secure.

If you have any more questions or need more info, just let me know.