Nw.js: Feature Request: Publish checksum hash of each version of each release

[barrykeegan]

Related to the now closed issue: https://github.com/nwjs/nw.js/issues/3228

The above issue had 2 requests in one. The first one, now implemented, was to make nwjs available to download over https.

The second request was to make the downloads somehow verifiable - whether by pgp key or publishing a list of hashes for each release. I presume publishing the list of hashes would be far easier to implement and was even done once upon a time, see: https://dl.nwjs.io/MD5SUMS

This issue is to make a formal request for the single issue of the publication of hashes each time a new release is published. While not a request for a feature within the nwjs software itself, I do think the added feature of some kind of verifiability for releases from the project will prove to be a benefit for the project as a whole.

And in case there is a need to specify a use case to justify the new feature please see an excerpt from my comment on the prior issue:

"I currently am the maintainer of the nwjs-sdk release on the arch user repository. This currently requires me to download the 64bit and 32bit versions (which is slow), run sha1sum over them (without knowing whether or not they got corrupted on the way) and updating the PKGBUILD file with the relevant release version and sha1sum info for makepkg to use for verification (again without knowing if the sha1sum was generated from a corrupted file).

It would be much better if just after building each release a checksum document of some sort (hosted on github) would be updated with the latest release checksums generated from a known clean build of the release in question."

[cmcfarla]

This is still an issue. For some reason, there _is_ a SHASUM256.txt file in all the newer releases but it only has the checksum for the _header_ download. e.g. https://dl.nwjs.io/v0.17.4/SHASUMS256.txt shows only:

54dcabd6492c4314782b3f637ae30f0a73e9839cfcc2b143f732caae804245ac nw-headers-v0.17.4.tar.gz

and nothing else.

Is there a bug in the publishing mechanism, perhaps?

[rogerwang]

Fixed in 0.32.0 and later: https://github.com/nwjs/nw.js#verifying-binaries