You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@zookeeper.apache.org by "Chris Nauroth (JIRA)" <ji...@apache.org> on 2015/10/14 17:48:05 UTC

[jira] [Resolved] (ZOOKEEPER-2292) Sign the download package

     [ https://issues.apache.org/jira/browse/ZOOKEEPER-2292?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chris Nauroth resolved ZOOKEEPER-2292.
--------------------------------------
    Resolution: Duplicate

> Sign the download package
> -------------------------
>
>                 Key: ZOOKEEPER-2292
>                 URL: https://issues.apache.org/jira/browse/ZOOKEEPER-2292
>             Project: ZooKeeper
>          Issue Type: Improvement
>          Components: build
>            Reporter: Elias Levy
>            Assignee: Chris Nauroth
>
> Current ZK is made available for download as a compressed archive.  Within the archive, there is a cryptographic signature for the ZK JAR file. Alas, the signature does not cover any of the other executable components that ZK depends on, such as JARs in the lib directory or the scripts in the bin directory.  These could be tampered with.
> The whole download package should be signed and the signature made available along with it.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)