-
-
Notifications
You must be signed in to change notification settings - Fork 15
Absolute path leaks into .sha256 files for release checksums #91
Copy link
Copy link
Closed
Description
Release checksum *.sha256 files contain absolute path to the compiled binary, making verification a bit cumbersome after download:
$ cd ~/Downloads
$ sha256sum -c pact-plugin-cli-macos-aarch64.gz.sha256
sha256sum: /Users/runner/work/pact-plugins/pact-plugins/release_artifacts/pact-plugin-cli-macos-aarch64.gz: No such file or directory
/Users/runner/work/pact-plugins/pact-plugins/release_artifacts/pact-plugin-cli-macos-aarch64.gz: FAILED open or read
sha256sum: WARNING: 1 listed file could not be read
Origin .sha256 file:
af1505f0aff261fc98608473b529674d87ceaedb3c426a1e6ba53ad00e1e630b */Users/runner/work/pact-plugins/pact-plugins/release_artifacts/pact-plugin-cli-macos-aarch64.gz
After cleaning the path, it works as expected:
$ sha256sum -c pact-plugin-cli-macos-aarch64.gz.sha256
pact-plugin-cli-macos-aarch64.gz: OK
Expected .sha256 file content:
af1505f0aff261fc98608473b529674d87ceaedb3c426a1e6ba53ad00e1e630b pact-plugin-cli-macos-aarch64.gz
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels