volta-cli
Install script does not verify release integrity
The install script calls download_release_from_repo then install_from_file, but it extracts the release without verifying integrity or authenticity. An attacker who can replace a release artifact (or a compromised intermediary/CA) could supply a malicious archive and it would be installed silently.
Please consider adding GPG-signed release artifacts / signatures (or a signed checksum manifest). Just using HTTPS isn't an adequate root of trust against repo compromise, compromised signing accounts, CA compromises, or targeted attacks.
@Muktarsadiq: this one is for sure available, same issue, in a project with much more visibility if you want to work on it:
https://github.com/ollama/ollama/issues/5338
@Muktarsadiq: this one is for sure available, same issue, in a project with much more visibility if you want to work on it:
Awesome, thanks for confirming! I’d like to contribute to both if possible, starting with this one to get familiar, and then moving on to the higher visibility project.