dd-trace-php icon indicating copy to clipboard operation
dd-trace-php copied to clipboard
verified publisher icon DataDog

[Feature] Provide release download checksums

Open msimkunas opened this issue 5 months ago • 3 comments

Describe the feature you'd like

Would it be possible to provide checksums for every GitHub release?

Is your feature request related to a problem?

No response

Describe alternatives you've considered

No response

Additional context

No response

msimkunas avatar Jul 25 '25 16:07 msimkunas

In addition, the datadog-setup.php script itself should verify the downloaded release to check against tampering.

msimkunas avatar Jul 25 '25 17:07 msimkunas

Looks like github now automatically computes checksums for release artifacts:

Image

However datadog-setup.php does not validate the checksums yet. I do agree that it should.

bwoebi avatar Jul 29 '25 17:07 bwoebi

Could this be prioritized? I would argue that datadog-setup.php checking the checksums is a bare minimum for any serious use, especially in enterprise environments.

msimkunas avatar Jul 29 '25 17:07 msimkunas