Thank you for maintaining the Hive CLI.
The documented installer currently downloads a platform archive from cli.graphql-hive.com and extracts it without verifying a publisher-provided checksum or signature. Downstream consumers that pin the CLI therefore have to download each archive, calculate their own hashes, and trust that initial download. Which is a bit of a charade, which is the reason for this request.
Would you consider generating a SHA256SUMS manifest during the existing release workflow, covering all supported archives, and publishing it at:
Plain text
https://cli.graphql-hive.com/versions/VERSION/SHA256SUMS
It would also be helpful for install.sh to verify the selected archive before extraction.
Publishing the archives and checksum manifest on the corresponding GitHub release would provide a separate, discoverable source for downstream package definitions and pinned installations. As a further improvement, immutable releases and GitHub artifact attestations or Sigstore signing could bind the artifacts to the release workflow and source commit.
Publisher-generated hashes would be a useful first step and remove the need for consumers to establish their own trust-on-first-use pins.
Would this fit Hive’s current release model?
Thank you for maintaining the Hive CLI.
The documented installer currently downloads a platform archive from
cli.graphql-hive.comand extracts it without verifying a publisher-provided checksum or signature. Downstream consumers that pin the CLI therefore have to download each archive, calculate their own hashes, and trust that initial download. Which is a bit of a charade, which is the reason for this request.Would you consider generating a
SHA256SUMSmanifest during the existing release workflow, covering all supported archives, and publishing it at:Plain text
It would also be helpful for
install.shto verify the selected archive before extraction.Publishing the archives and checksum manifest on the corresponding GitHub release would provide a separate, discoverable source for downstream package definitions and pinned installations. As a further improvement, immutable releases and GitHub artifact attestations or Sigstore signing could bind the artifacts to the release workflow and source commit.
Publisher-generated hashes would be a useful first step and remove the need for consumers to establish their own trust-on-first-use pins.
Would this fit Hive’s current release model?