Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bundle dependencies #175

Open
taoeffect opened this issue Mar 26, 2016 · 0 comments
Open

Bundle dependencies #175

taoeffect opened this issue Mar 26, 2016 · 0 comments
Labels
enhancement high priority security

Comments

@taoeffect
Copy link
Member

taoeffect commented Mar 26, 2016 •
edited by john-light

We already specify precise version numbers, but this isn't enough.

Truthfully, bundling dependencies is insufficient as well, for the way DNSChain gets installed is via npm install and that requires trusting X.509 + NPM.

Still, bundling dependencies is a meaningful improvement we can do.

At some point in the future a way to sign DNSChain releases would be useful. This could be accomplished by distributing DNSChain as a tar+gzip'd file and using a special loader to run it. The signature could be verified via a blockchain.

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement high priority security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@taoeffect