mirror of
https://github.com/opentffoundation/opentf.git
synced 2026-04-11 15:00:46 -04:00
Fetch the SHA256SUMS file and verify it's signature before downloading any plugins. This embeds the hashicorp public key in the binary. If the publickey is replaced, new releases will need to be cut anyway. A --verify-plugin=false flag will be added to skip signature verification in these cases.