Calculate SHA256SUM of remote objects about zarf HOT 3 CLOSED

Will update the OP to reflect that warning, so we don't have to read all the comments to get full context

from zarf.

I definitely understand the convenience of this, but do think we should think about the user behavior this could create too.

Ideally, we would only use zarf prepare shasum when there isn’t one published already. Otherwise you’re kind of defeating the purpose of validating the remote download. E.g., for K3s we use the shasums published to make the zarf package. We only manually calculate a shasum if there isn’t a published one already.

Maybe we add the feature but put a warning stating they should used a published shasum instead if one is available. Thoughts?

from zarf.

Maybe we add the feature but put a warning stating they should used a published shasum instead if one is available. Thoughts?

Yep, that sounds good. Agree with preferring the published checksum, but this would be nice if there isn't one available.

from zarf.