[GitHub] jasonpet closed pull request #164: added checksum verification for https://deb.nodesource.com/setup_8.x

[GitBox <gi...@apache.org>]

jasonpet closed pull request #164: added checksum verification for https://deb.nodesource.com/setup_8.x
URL: https://github.com/apache/incubator-openwhisk-package-alarms/pull/164
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/Dockerfile b/Dockerfile
index f823a5f..94e8cbf 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,7 @@
 FROM ubuntu:14.04
 
 ENV DEBIAN_FRONTEND noninteractive
+ENV NODE_SETUP_DOWNLOAD_SHA 30084249bdd56119cb61be682a56829a11a4c94e21c5d005d326dedb66776104
 
 # Initial update and some basics.
 # This odd double update seems necessary to get curl to download without 404 errors.
@@ -10,7 +11,10 @@ RUN apt-get update --fix-missing && \
   apt-get install -y curl && \
   apt-get update && \
   apt-get remove -y nodejs && \
-  curl -sL https://deb.nodesource.com/setup_8.x | bash - && \
+  curl -sL https://deb.nodesource.com/setup_8.x -o setup_8.x && \ 
+  echo "${NODE_SETUP_DOWNLOAD_SHA}  setup_8.x" | sha256sum -c - && \
+  cat setup_8.x | bash - && \
+  rm setup_8.x && \
   apt-get install -y nodejs
 
 # only package.json


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services