Ignore known files from checksum? about checksum-command HOT 3 CLOSED

Why?

from checksum-command.

That would open up a potential security vulnerability, where an attacker would not only upload malicious files, but also a .distignore file to ignore the newly added files.

In general, I think that the files that are found in .distignore should not be part of the packaged release (that is the point of that file), so they should not appear either in the generated checksums nor in the installation to check. Otherwise, I would expect a warning indeed, as my installation does not match what was released.

from checksum-command.

I was suggesting a list of known files that would be ignored from the code of the command instead of reading the local .distignore from the plugin. something like the plugin-distignore.mustache.

But I agree with @schlessera

so they should not appear either in the generated checksums nor in the installation to check. Otherwise, I would expect a warning indeed, as my installation does not match what was released.

from checksum-command.