> you should at least validate checksums on external files before executing or using them. I would do that by getting the checksum off the website, and hardcod

> you should at least validate checksums on external files before executing or using them. I would do that by getting the checksum off the website, and hardcoding it into my Dockerfile, right? At that point I've pegged to a version, and I might as well just keep the binary local and COPY it in. Is that right? And am I accidentally reviving the 'evergreen fight'? :)