You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While both of these have the same MD5 signature today, content stored in China is subject to regulation and laws that easily open Seafile up to a supply chain attack for anyone using the Docker container image. It would be trivial to change the source of the version in China and have that shipped out across the world.
For a product that manages files and data for individuals and organizations, this would be a disaster.
Can the Dockerfile pull from the same endpoint as the docs? Extra credit if you publish the MD5 signature in the docs and validate it from a public HTTP endpoint (e.g. https://seafile.com/hash/8.0.7) during the Docker build.
The text was updated successfully, but these errors were encountered:
The docs list an S3 endpoint for downloading the source, but the Dockerfile instead pulls from a server in China.
While both of these have the same MD5 signature today, content stored in China is subject to regulation and laws that easily open Seafile up to a supply chain attack for anyone using the Docker container image. It would be trivial to change the source of the version in China and have that shipped out across the world.
For a product that manages files and data for individuals and organizations, this would be a disaster.
Can the Dockerfile pull from the same endpoint as the docs? Extra credit if you publish the MD5 signature in the docs and validate it from a public HTTP endpoint (e.g. https://seafile.com/hash/8.0.7) during the Docker build.
The text was updated successfully, but these errors were encountered: