Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encourage Users to verify checksums for wget'd scripts. #71

Closed
ptheywood opened this issue Sep 21, 2021 · 1 comment · Fixed by #93
Closed

Encourage Users to verify checksums for wget'd scripts. #71

ptheywood opened this issue Sep 21, 2021 · 1 comment · Fixed by #93

Comments

@ptheywood
Copy link
Member

Users are currently told to wget and execute arbitrary scripts during conda installation (and potentialyl others) to install tensorflow etc.
Users will download and run arbitrary scripts if it allows them to get work done, so rather than fight it we should strongly encourage users to verify the integrity of scripts (via checksums) and ideally inspect them prior to execution.

Any examples of this in the docs should be updated to include this (i.e. conda installation).

@ptheywood
Copy link
Member Author

Currently, the occurences of wget are in:

  • easybuild
  • conda
  • tensorflow (for conda)
  • pytorch (for conda)
  • wmlce (for conda)

For the generic conda instructions I've added example use of sha256sum to and a comment suggestion to look the value up from the conda website in #67 , however as the latest conda is requested not a known version we can't provide a known hash in the documentation.

It may be better to change the examples to fetch specific versions of conda, and include the known hash for the provided version in the sample code blocks, with the location of where to find the expected checksums as text?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant