4 ms·
This has been covered here before[0]. And I remember the questionable approach to add some of its dependencies[1]. I like meilisearch and used it in one project
by whilenot-dev 3y ago
This has been covered here before[0]. And I remember the questionable approach to add some of its dependencies[1]. I like meilisearch and used it in one project, but downloading some binary at runtime isn't really trustworthy IMHO.
[0]: https://news.ycombinator.com/item?id=36882146 https://news.ycombinator.com/item?id=36882146
[1]: https://github.com/continuedev/continue/blob/33a0436193aa65a368d53570b79fe46b8b07aa34/server/continuedev/server/meilisearch_server.py#L28 https://github.com/continuedev/continue/blob/33a0436193aa65a...
- biosboiii 3y agoThe download path is hardcoded to be the binary release of a github project. I don't know any other, more trustful way to download MeiliSearch rather than doing this. You could download the source, and build it from scratch, but that also requires trust in the same exact Github repo which build the binary. If your threat model is that Github repo being compromised, you can't escape that either.
- whilenot-dev 3y agoThe windows version is fixed, the posix version is depending on whatever meilisearch decides. A digital signature check would be great for supply chain security, eg. with cosign[0]. meilisearch prob won't make any effort there, since they want customers on their cloud offering. [0]: https://docs.sigstore.dev/signing/signing_with_blobs/ https://docs.sigstore.dev/signing/signing_with_blobs/