Docs: Should install page have a checksum?

[rmloveland]

I think it's worth considering adding a couple of steps to the Download the Binary tab of [Install CockroachDB] to show users how to validate the download they're getting using a checksum.

However, I'm definitely not a security expert.

Is this a non-issue since we use HTTPS for the downloads?

(FWIW I tried to change the binary download URL to use HTTP and it auto-upgrades to HTTPS, so that's good I guess.)

@mberhault AFAICT you know about security things - what do you think?

[mberhault]

It wouldn't hurt. Binary shas are useful to allow people to check that binaries downloaded from third parties (proxies, other websites, etc...) are official ones and have not been tampered with.

[bdarnell]

It wouldn't hurt, but it also wouldn't help much. Traditional open source distribution relied on things like mirror networks where the binaries came from a different source from the instructions, but that's not how it generally works for us. Even the other distributors like brew build their own binaries; they don't redistribute ours. I don't think it's worth the complexity of adding checksums to the installation pages.

[rmloveland]

Thanks for weighing in @mberhault and @bdarnell ! Based on these responses it seems like we range from "ok i guess" to "no thanks", so I'll just close this.

[BramGruneir]

There have been a number of requests on gitter to expose them. I think we should reconsider this, even if we slightly hide them in a link.

[clakeb]

I think it doesn't hurt. For the scenario I want to use them (add cockroach the gofish package manager) it is nice. But since gofish would be downloading the binaries directly I guess it doesn't matter. I like @BramGruneir's suggestion of hiding them possibly.

[jseldess]

@aaron-crl, @thtruo, can you chime in here?

[aaron-crl]

Since we control the distribution of binaries and they are delivered under TLS (the same transport as the checksums) it really doesn't add anything from a security standpoint.

The engineering cost to add that to the release process is non-negligible so I would be disinclined to provide this.

[jseldess]

Thanks, @aaron-crl. I'll close this issue for now. If this topic becomes a priority, we can re-open.