I think sha512sum check at build time should be added for this one as the content of the link it points to can be altered by the author at anytime without anyone noticing.

@zonyitoo For the time being, I suggest we create a new repository under the shadowsocks org then move the same artifacts to the newly created repository so that only trusted individuals can modify them. This should be fairly trivial IMO.

I had actually thought about this issue before, but I am not familiar with docker at all, never use it. Pull requests are welcome if you can add hardcoded sha512sum check.

Yes. Moving the artifacts to a new repo of shadowsocks org is preferred.

I think sha512sum check at build time should be added for this one as the content of the link it points to can be altered by the author at anytime without anyone noticing.

@zonyitoo For the time being, I suggest we create a new repository under the shadowsocks org then move the same artifacts to the newly created repository so that only trusted individuals can modify them. This should be fairly trivial IMO.

That is reasonable. @madeye what do you think?