I'm worried people will forget this is turned off and not realize we're exposing ourselves #12

Activity

1. dprotaso commented on Nov 16, 2020

   

   dprotaso

   on Nov 16, 2020

   Member

   More actions

   Further discussion:
   https://knative.slack.com/archives/CCSNR4FCH/p1604425778429100
2. krsna-m commented on Sep 19, 2023

   

   krsna-m

   on Sep 19, 2023

   Last edited by krsna-m

   Contributor

   More actions

   Slack context is lost please reopen with context whenever
3. krsna-m

   closed this as completedon Sep 19, 2023
4. dprotaso commented on Sep 19, 2023

   

   dprotaso

   on Sep 19, 2023

   Last edited by dprotaso

   Member

   More actions

   Context:

   When we fetch dependencies we were getting 4xx errors because they didn't show up in the module mirror and checksum database (there's a bit of a delay). To avoid this we turned off using the mirror and the checksum db. Doing this opens us up to a potential supply chain attack - since we aren't verifying the sums.

   Settings are here: https://go.dev/ref/mod#checksum-database
5. dprotaso

   reopened this on Sep 19, 2023
6. dprotaso commented on Sep 19, 2023

   

   dprotaso

   on Sep 19, 2023

   Member

   More actions

   I think the env var settings let you tweak which modules we do verification on - that could be an minimal option here.