Skip to content

build: verify Apache RAT jar checksum before execution#908

Open
fallintoplace wants to merge 2 commits into
apache:mainfrom
fallintoplace:fix-rat-verification
Open

build: verify Apache RAT jar checksum before execution#908
fallintoplace wants to merge 2 commits into
apache:mainfrom
fallintoplace:fix-rat-verification

Conversation

@fallintoplace

Copy link
Copy Markdown
Contributor

Summary

  • Pin to a fixed Apache RAT version check and verify its SHA-512 checksum before running
  • Add committed checksum file
  • Fail fast if checksum missing or mismatched to avoid executing unverified jars

Testing

  • Not run (release helper script hardening change only).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant