Julia: [security problem] By allowing to download the source code without checking cryptographic hash Julia subjects users to the possibility of MITM attacks

[yurivict]

For example, here is the URL of Tk: https://github.com/JuliaGraphics/Tk.jl/blob/master/deps/build.jl#L21
No cryptographic hash accompanies this URL. This means that anybody who has access to the network signal can substitute such file with a malicious copy.

As an example, R language also downloads packages, but they always check MD5 hash. Another example: every source FreeBSD downloads to build any port is always checked against sha256 fingerprints.

Please make cryptographic hash required for all downloads (both http and https).

[quinnj]

It'd be more useful to submit an issue to the Tk.jl package github repository; there are two new Julia packages, BinaryBuilder.jl and BinaryProvider.jl which provide an updated workflow for building and installing secure binaries, which would solve this problem.

[yurivict]

Many modules have this problem. Here is another example: https://github.com/JuliaGraphics/Cairo.jl/blob/master/deps/build.jl#L101
This is a systemic problem in Julia, that's why I created it here. If I'll be chasing down individual packages, this will never be solved.

[Liso77]

Maybe Tk has to be removed from official repository and Pkg3/Pkg has to inform about this "banning" process and propose to uninstall it.

[KristofferC]

Better would be to port these packages to the new build system that does hash checking. Help doing that is greatly appreciated.

[stevengj]

I think it would be better to enforce an SHA validation on all download calls during Pkg.build, as implemented in #26683.

[StefanKarpinski]

There doesn't seem to be anything to do in this repository, is there?

[yurivict]

Then you should forward it to the right repository.

[KristofferC]

It seems you found the repository. Opening an issue there would be very helpful.

[stevengj]

@StefanKarpinski, in this repository, we could enforce that all download calls during Pkg.build
do an SHA check, which would be more effective than filing issues in packages one by one.

[yurivict]

Yes, it sounds like a great idea to enforce SHA checks for all Pkg.build calls.