implement checksum verification #4

New issue

Open

opened 2026-05-17 13:21:02 +00:00 by rc · 0 comments

rc commented

2026-05-17 13:21:02 +00:00

Owner

vmz download downloads alpine's initrafms-virt and vmlinuz-virt files, alpine linux does not provide checksums for netboot files, we would benefit a lot from having checksums and validating them, we have a few options:

ask alpine team to publish those (nah)
serve checksums on an host we control (f.rcast.dev) or some random s3 instance, embedding them in the binary does not work as users would not be able to checksum alpine versions after the release
????

`vmz download` downloads alpine's `initrafms-virt` and `vmlinuz-virt` files, alpine linux does [not provide checksums for netboot files](https://dl-cdn.alpinelinux.org/alpine/latest-stable/releases/aarch64/netboot-3.23.4/), we would benefit a lot from having checksums and validating them, we have a few options: + ask alpine team to publish those (nah) + serve checksums on an host we control (`f.rcast.dev`) or some random s3 instance, embedding them in the binary does not work as users would not be able to checksum alpine versions after the release + ????