Release via GitHub with SHA

[raphaklaus]

Downloading it via a static AWS link kind of sucks and is not secure. :\

[al2613]

Hey Raphael,

Thanks for the feedback! The download link is a secure connection so we're not sure what you're referring to exactly? Can you provide us with more specific details?

Thanks,
Annette

[raphaklaus]

No, no. I mean, there is no way to ensure the build from AWS is from this source code. You should provide the SHA signature along with the build link from the build system used (Circle, Jenkins, etc).

Search for best security practices using SHA algorithm in open source projects.