docker-nexus icon indicating copy to clipboard operation
docker-nexus copied to clipboard

Checking java download against a checksum for security

Open SafPlusPlus opened this issue 7 years ago • 0 comments

Since Oracle's JRE is being downloaded over HTTP, but not checked against a secure checksum, I considered this a bit of a security issue. I added a variable for a sha256 checksum and checked against this after the download in the OSS and Pro dockerfiles.

Oracle supplies these checksums officially for this version at https://www.oracle.com/webfolder/s/digest/8u102checksum.html

Subsequent updates of the JRE version in these dockerfiles should update the checksum accordingly.

Feel free to give me feedback if the change should need more work. :)

SafPlusPlus avatar Nov 29 '16 12:11 SafPlusPlus