4 ms·
The download path is hardcoded to be the binary release of a github project. I don't know any other, more trustful way to download MeiliSearch rather than doin
by biosboiii 3y ago
The download path is hardcoded to be the binary release of a github project.
I don't know any other, more trustful way to download MeiliSearch rather than doing this.
You could download the source, and build it from scratch, but that also requires trust in the same exact Github repo which build the binary.
If your threat model is that Github repo being compromised, you can't escape that either.
- whilenot-dev 3y agoThe windows version is fixed, the posix version is depending on whatever meilisearch decides. A digital signature check would be great for supply chain security, eg. with cosign[0]. meilisearch prob won't make any effort there, since they want customers on their cloud offering. [0]: https://docs.sigstore.dev/signing/signing_with_blobs/ https://docs.sigstore.dev/signing/signing_with_blobs/