-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cherry-pick #18876 to 7.x: Agent verifies packages before using them #18928
Conversation
…8876) [Ingest Manager] Agent verifies packages before using them (elastic#18876)
Pinging @elastic/ingest-management (Team:Ingest Management) |
💔 Tests FailedExpand to view the summary
Build stats
Test stats 🧪
Test errorsExpand to view the tests failures
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Backport looks good.
💔 Tests FailedExpand to view the summary
Build stats
Test stats 🧪
Test errorsExpand to view the tests failures
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
Cherry-pick of PR #18876 to 7.x branch. Original message:
What does this PR do?
This PR enables hash verification of downloaded tar/zip packages and dont proceed with installation if package is corrupted.
In order to do that we have to include sha512 hashes while packaging.
Why is it important?
This is important in case repo contains invalid archive or somebody tempered content of tar package.
We still need to verify signature (will be done in a followup)
Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Fixes: #17915