[IMPALA-3185] Toolchain should verify download hash

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: Impala 2.5.0
• Component/s: Infrastructure
• Labels: security
• Assignee: Unassigned
• Reporter: Jim Apple
• Created: 15/Mar/16 20:27
• Updated: 23/Oct/18 23:40

Description

According to https://issues.cloudera.org/browse/IMPALA-3184 , the toolchain downloads things from the public internet over ftp. It should only use encrypted connections like sftp and it should check hashes when possible.