-
Notifications
You must be signed in to change notification settings - Fork 20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use go-plugin's internal mechanism for verifying checksum #78
Comments
This should be done at a later time and I'll remove it from the v0.2.0 milestone. The reason is that there should be a trusted repository to hold the checksums, so that GatewayD can verify the plugins against them. Otherwise the plugins can be downloaded from GitHub and the checksums should reside next to the release files and used in the |
The gatewayd-plugin-cache is released. Each gunzipped tar file contain the binary and the checksum of the binary file. The plugin command (#122) can leverage this to include the checksum in the |
This requires checksums to be loaded securely, rather than being hard-coded in the plugin config file.
The text was updated successfully, but these errors were encountered: