Asdf: Ensure plugins authenticate downloaded files

[ypid]

A few plugins seem to be maintained as part of asdf-vm. Please ensure that those plugins properly authenticate downloaded files.

[Stratus3D]

@ypid good catch.

We have a plugin-test command that ensures plugins work properly and meet our standards. Can you think of a way to automatically check for HTTP downloads in our plugin-test command? I suppose we stub curl and wget and see what arguments they are passed. If it's not automated it's probably not going to happen...

[ypid]

The easiest and most effective step would be to check all source code of plugins and enforce that no unauthenticated legacy HTTP connection attempts are to be made. Ref: https://github.com/asdf-vm/asdf-nodejs/pull/16

And maybe a warning could be given if no gpg command is used which is commonly used to verify signatures.

[danhper]

I will close this issue, as it has been inactive for a long time now.
If there is still interest, please feel free to open a new issue.
Thank you!