Relax checksum requirement - #323
Conversation
We're finding cases where our checksum comparison algorithm is insufficient. Better to log and proceed rather than block deployment in those cases.
|
I'm in favour of merging this in to unblock, but this could cause issues with compliance, @getsentry/security do y'all have any thoughts before we push forward with it? |
|
Original reason to do the checksum was less security-related and more that we uploaded an old version as if it were the new version (if I remember right, would have to dig). |
|
Tbh I don't feel really comfortable merging this since we may be releasing the wrong files. And I also wonder about security implications; if there aren't any, I guess we could merge this to unblock new releases. |
|
@iker-barriocanal Fair enough. Do you have any bandwidth to work on a better solution? |
|
Ship it. This is good enough of a solution for now and there are no concerns from a compliance perspective. |
|
@chadwhitacre yes, in progress. |
|
having the same issue, can we get a patch release? otherwise I'm blocked to finish the release |
|
@marandaneto We use |
|
Ah, nice @AbhiPrasad. Coming here to say that I did kick off an 0.27.1 release as well: https://github.com/getsentry/craft/actions/runs/1449358202 |
that works, sweet, thanks for the quick release |
This is a workaround for #322, where we're finding that our checksum comparison algorithm is not always sufficient. Better to log and proceed rather than block deployment in such cases.