Verify integrity of the downloaded content

[mensfeld]

Hey,

My name is Maciej Mensfeld, and I do supply chain security research at Mend.io.

I've noticed, that this library downloads external binaries and uses them. While it's a common pattern, integrity verification is lacking here.

This is described as CWE-494.

You could verify the integrity of the downloaded file before using it by comparing the file hash to a hardcoded, expected file hash.

This is essentially what package managers do to verify the integrity of downloaded packages.

Doing this would prevent attack scenarios in which the binaries downloaded here are manipulated.

If the verification happens elsewhere sorry in advance and I would love it if you could point me to the location, so I can tune up my scanning engine.

Have a great day :)