Feature request: Abbility to verify checksum with the ADD command

[TravisEz13]

See the twitter conversation https://twitter.com/thaJeztah/status/1124310628888244224

I imagine the syntax like

ADD --checksum=sha256:.... https://..<remote file> 

cc @thaJeztah

[thaJeztah]

ping @tonistiigi this was the proposal I was talking about; wdyt?

[tonistiigi]

@thaJeztah I think I'm ok with it. It is only for URLs, right? No changes should be required in the engine as LLB already supports checksum https://godoc.org/github.com/moby/buildkit/client/llb#Checksum . It also helps with caching because now the URL is immutable and there is no need to check it the content has been changed.

[TravisEz13]

Yes, only for URLs. Right now we are downloading and verifying the checksum is a separate step.

[AkihiroSuda]

PR

• dockerfile (labs): implement ADD --checksum=<checksum> <http src> <dest> #3093

[thaJeztah]

Yes, only for URLs. Right now we are downloading and verifying the checksum is a separate step.

I left a comment on the PR; I think (as a future enhancement?) support for checksums for local sources may also be nice to have; #3093 (comment)

Happy to see work in progress on this feature; really useful 👍

[fenollp]

@thaJeztah Was your point on checksuming "local files" (for remote builder contexts) answered somewhere? Is it already implemented?

[thaJeztah]

I don't think it was implemented for local files, but perhaps some of that required some motivation (assuming both the Dockerfile and the file copied are part of your local files, what's the added value of the checksum).

Opening a separate ticket with more details is probably fine for discussing some of that

[thaJeztah]

for remote builder contexts

Oh! Overlooked this part (and it was a while since I commented 🙈

Same still applies though; a separate ticket is probably good!