Do not require specifying the shasum when fetching source

Question

Do not require specifying the shasum when fetching source

Opened this issue 9 years ago · 2 comments

If no shasum is provided the cookbook should attempt to fetch the SHASUMS.txt file, parse that file, and determine the shasum automatically. This would make it much easier to specify a version to install. We're doing this in the tomcat cookbook right now and it's working nicely.

Answer 1 · 2016-08-10T17:35:46.000Z

I am using without a checksum, just version seems to fetch. I'm not sure that auto-fetching the checksum from the same domain at the same time adds any additional security (given nodejs.org hacked or dns poisoning.)

Answer 2 · 2020-09-30T00:46:17.000Z

Marking stale due to inactivity. Remove stale label or comment or this will be closed in 7 days. Alternatively drop by the #sous-chefs channel on the Chef Community Slack and we'll be happy to help! Thanks, Sous-Chefs.