{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/kibana/issues/7136","repository_url":"https://api.github.com/repos/elastic/kibana","labels_url":"https://api.github.com/repos/elastic/kibana/issues/7136/labels{/name}","comments_url":"https://api.github.com/repos/elastic/kibana/issues/7136/comments","events_url":"https://api.github.com/repos/elastic/kibana/issues/7136/events","html_url":"https://github.com/elastic/kibana/issues/7136","id":153138417,"number":7136,"title":"[build] Verify SHA checksums of downloaded node executables","user":{"login":"ycombinator","id":51061,"avatar_url":"https://avatars.githubusercontent.com/u/51061?v=3","gravatar_id":"","url":"https://api.github.com/users/ycombinator","html_url":"https://github.com/ycombinator","followers_url":"https://api.github.com/users/ycombinator/followers","following_url":"https://api.github.com/users/ycombinator/following{/other_user}","gists_url":"https://api.github.com/users/ycombinator/gists{/gist_id}","starred_url":"https://api.github.com/users/ycombinator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ycombinator/subscriptions","organizations_url":"https://api.github.com/users/ycombinator/orgs","repos_url":"https://api.github.com/users/ycombinator/repos","events_url":"https://api.github.com/users/ycombinator/events{/privacy}","received_events_url":"https://api.github.com/users/ycombinator/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/kibana/labels/discuss","name":"discuss","color":"cc317c"},{"url":"https://api.github.com/repos/elastic/kibana/labels/P1","name":"P1","color":"000000"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-05-04T23:25:47Z","updated_at":"2016-05-04T23:56:05Z","closed_at":null,"body":"While testing #6267, @LeeDr noticed that the build ended up packaging a [bad `node.exe` file](https://github.com/elastic/kibana/pull/6267#issuecomment-217025180). It turned out that the `node.exe` file downloaded by the build process into the `.node_binaries` folder was bad.\r\n\r\nI looked at [the code where the various node executables are downloaded](https://github.com/elastic/kibana/blob/master/tasks/build/download_node_builds.js); it appears we only check for a HTTP 200 status code to determine success. Perhaps we should also compare the SHA checksums ([example for v4.3.2](https://nodejs.org/dist/v4.3.2/SHASUMS256.txt)) of the downloaded node executables before proceeding further in the build?\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/kibana/issues/comments/217042164","html_url":"https://github.com/elastic/kibana/issues/7136#issuecomment-217042164","issue_url":"https://api.github.com/repos/elastic/kibana/issues/7136","id":217042164,"user":{"login":"epixa","id":53814,"avatar_url":"https://avatars.githubusercontent.com/u/53814?v=3","gravatar_id":"","url":"https://api.github.com/users/epixa","html_url":"https://github.com/epixa","followers_url":"https://api.github.com/users/epixa/followers","following_url":"https://api.github.com/users/epixa/following{/other_user}","gists_url":"https://api.github.com/users/epixa/gists{/gist_id}","starred_url":"https://api.github.com/users/epixa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/epixa/subscriptions","organizations_url":"https://api.github.com/users/epixa/orgs","repos_url":"https://api.github.com/users/epixa/repos","events_url":"https://api.github.com/users/epixa/events{/privacy}","received_events_url":"https://api.github.com/users/epixa/received_events","type":"User","site_admin":false},"created_at":"2016-05-04T23:56:05Z","updated_at":"2016-05-04T23:56:05Z","body":"To clarify, I didn't mean to imply that I think we *are* checking for shas.  We should just start if we aren't already."}}