Buck & SHA1s for bits pulled from Maven-land ?

[Paul Hammant]

Should Buck have co-located SHA1s for use when verifying binarys procured from elswhere on the internet?  https://shattered.io notwithstanding.

Ref: https://github.com/SeleniumHQ/selenium/pull/7414/files

e.g. https://github.com/SeleniumHQ/selenium/blob/a64df7271f4c1468064fe53d4bf0cf3a768df23d/third_party/java/okio/okio-2.2.2.jar is sourced from https://repo1.maven.org/maven2/com/squareup/okio/okio/2.2.2/ where the SHA1 is too.

Being able to run a command to confirm that these were correctly sourced would be super cool :)

- Paul