Sha checking remote task files ?

[joeblew999]

Is there Sha checking to validate the remote files ?

Would be more secure in terms of trust .

I have them on Cloudflare R2 at the moment. The GitHub action uploads them in CI

[trulede]

This sounds like a reasonable (good) extension to the existing behavior; if the calculated checksum does not match the expected checksum then do not run the task - a variation on the second case below.
https://taskfile.dev/experiments/remote-taskfiles/#security

[joeblew999]

thats basically it yes.

the Sha will need to be saved with the remote task file though ? so its annoying for some devs as you have to keep the Sha up to date.

[trulede]

#2222 check that issue

[joeblew999]

I think we can close this ??