News for hackers. Stuff that matters.

A comment on Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled. Parent comment

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by ithkuil on Saturday April 27, 2019 @01:20PM (#19766550)
Can't the hash be verified by the client too?
[ Parent | on HN ]
Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by subway on Saturday April 27, 2019 @01:47PM (#19766700)
Sure, but who tells the client what the correct hash is?
[ Parent | on HN ]
Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by krferriter on Saturday April 27, 2019 @05:06PM (#19767638)
If you're the entity who created the image you can retain the original hash and verify it against the downloaded copies. But that kind of defeats the purpose of being able to download docker images across distributed hosts.

They'd really need to be signatures attached to the images, not just hashes.

[ Parent | on HN ]