verify downloads using sha256?

[obfusk]

Most recipe downloads use https -- but some use http! -- which should provide reasonable security for most scenarios.
But IMHO best practice would be to verify sha256 hashes "just in case". And always for for http downloads!

I'm not sure how to handle the case where the user specifies a different version yet.
Might be good to have a mapping of (historical) versions to shasums instead of only the sum for the latest version?

(This would replace the current -- seldomly used -- md5sum.)

[AndreMiras]

Thank you for bringing it to the discussion.
I think we're better of simply moving all the remaining http to https

[obfusk]

I think we're better of simply moving all the remaining http to https

FYI: the official libxml2 site doesn't have working https. Downloading from gitlab or github should work though.

[AndreMiras]

Shame on them, yes I'd definitely go for gitlab/github then

[fuzzyTew]

#2351

[fuzzyTew]

#2351 has been merged; sha256sum may work in recipes now.