Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

What is the official image and the official latest release? #3509

Open
mrsarm opened this issue Apr 26, 2023 · 0 comments
Open

What is the official image and the official latest release? #3509

mrsarm opened this issue Apr 26, 2023 · 0 comments
Labels

Comments

@mrsarm
Copy link

mrsarm commented Apr 26, 2023

Most people with the intention to use this project will do using a pre-built docker image, but what is the official image? there is no link in the README. Also this projects has marked as latest release a version from the year 2017, and the tags... I don't know what mean those tags, doesn't look to match the real versions released.

In the official documentation here https://developers.bitgo.com/guides/get-started/express/install#install-with-docker 2 different images are used, from 2 different Docker Hub accounts, in the points 1. and 2. the image used is bitgo/express, while in the point 4. the image is bitgosdk/express. Both accounts have different set of versions, so... what is the official image? one seems to point to the other:

Screenshot from 2023-04-26 15-08-44

But with such a large README below is easy to not see it, moreover the one that may be the "official" account looks like it was created a by a kid testing what is Docker Hub: no README, and a few pulls compared with the old one:

Screenshot from 2023-04-26 14-57-37

This is a security issue, one may think that having the "latest" image is secure enough but is not because you are using an unmaintained image, or even worst, one can use a fake image found in the registry, because there is no clarity of what is the official image and what is the latest release.

In short, what I think you should do is:

  • Fix the documentation, only one is the official account, although a mention that there was an old account and you should move to the new one would be useful.
  • Add in the README of this project a link to the official Docker images.
  • Move the large README from the old Docker Hub account to the new account. In the old one, put in big that the account is deprecated and you should move to the new one.
  • Use the "Release" and "Tags" sections of Github properly, or don't use them at all.
@mrsarm mrsarm added the bug label Apr 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant