{"action":"created","issue":{"url":"https://api.github.com/repos/galaxy-iuc/standards/issues/14","repository_url":"https://api.github.com/repos/galaxy-iuc/standards","labels_url":"https://api.github.com/repos/galaxy-iuc/standards/issues/14/labels{/name}","comments_url":"https://api.github.com/repos/galaxy-iuc/standards/issues/14/comments","events_url":"https://api.github.com/repos/galaxy-iuc/standards/issues/14/events","html_url":"https://github.com/galaxy-iuc/standards/issues/14","id":93536233,"number":14,"title":"Require checksums on,  ALL downloads","user":{"login":"erasche","id":458683,"avatar_url":"https://avatars.githubusercontent.com/u/458683?v=3","gravatar_id":"","url":"https://api.github.com/users/erasche","html_url":"https://github.com/erasche","followers_url":"https://api.github.com/users/erasche/followers","following_url":"https://api.github.com/users/erasche/following{/other_user}","gists_url":"https://api.github.com/users/erasche/gists{/gist_id}","starred_url":"https://api.github.com/users/erasche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erasche/subscriptions","organizations_url":"https://api.github.com/users/erasche/orgs","repos_url":"https://api.github.com/users/erasche/repos","events_url":"https://api.github.com/users/erasche/events{/privacy}","received_events_url":"https://api.github.com/users/erasche/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2015-07-07T13:57:03Z","updated_at":"2016-03-08T17:34:28Z","closed_at":null,"body":"Was doing some late night reading and stumbled across [this rant](http://www.vitavonni.de/blog/201503/2015031201-the-sad-state-of-sysadmin-in-the-age-of-containers.html), because I enjoy reading articles by people with wildly different opinions from me so I'm not living in the \"Docker docker docker\" echo-chamber.\r\n\r\nI agree with the core point of the author, that we should be authenticating (to some extent) the binaries we download from the internet. Reading the code, we can add `#sha256#hash....` to all of our download urls, and that'll require checksums on them.\r\n\r\nThis is increasingly an important issue given certain government activities in the US, and abroad."},"comment":{"url":"https://api.github.com/repos/galaxy-iuc/standards/issues/comments/193881913","html_url":"https://github.com/galaxy-iuc/standards/issues/14#issuecomment-193881913","issue_url":"https://api.github.com/repos/galaxy-iuc/standards/issues/14","id":193881913,"user":{"login":"erasche","id":458683,"avatar_url":"https://avatars.githubusercontent.com/u/458683?v=3","gravatar_id":"","url":"https://api.github.com/users/erasche","html_url":"https://github.com/erasche","followers_url":"https://api.github.com/users/erasche/followers","following_url":"https://api.github.com/users/erasche/following{/other_user}","gists_url":"https://api.github.com/users/erasche/gists{/gist_id}","starred_url":"https://api.github.com/users/erasche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erasche/subscriptions","organizations_url":"https://api.github.com/users/erasche/orgs","repos_url":"https://api.github.com/users/erasche/repos","events_url":"https://api.github.com/users/erasche/events{/privacy}","received_events_url":"https://api.github.com/users/erasche/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T17:34:28Z","updated_at":"2016-03-08T17:34:28Z","body":"I'd say no, not until closer to GCC when we have more conda stuff done, and we can completely rewrite docs to reflect the new work."}}