Repository navigation
fix: refuse unverified installs and fork publishes - #16
Merged
Merged
Conversation
install.sh installed whatever it downloaded when the sums file was missing, did not name the asset, or no hash tool was present. It now refuses all three, matches the exact asset name rather than a substring, and reads the per-asset .sha256 the release already publishes before the combined checksums.sha256. Cross-build and Package ran their publish jobs after any successful CI run, fork pull requests included. Both now need the upstream run on main, in this repository, from a push or a dispatch. Re-runs no longer replace published bytes. Each upload writes nothing when its versioned marker file is already on R2, and build.rs stamps SOURCE_DATE_EPOCH or the commit time instead of the clock, so one commit builds one binary. Fixes #10
This was referenced Oct 14, 2026
|
Released in v1.5.12 -- https://github.com/hyperi-io/macbash/releases/tag/v1.5.12 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three supply-chain gaps from #10. The installer that
action.ymlpipes into every consumer's CI could install a binary it never verified, a fork PR could start the publish chain, and a re-run could swap the bytes behind a versioned URL.install.shfails closed. A missing sums file, a sums file without this asset, a mismatch, a download error or no SHA-256 tool all exit 1 with nothing installed. It reads the per-asset<asset>.sha256every release already publishes, falls back tochecksums.sha256, and matches the exact asset name rather than a substring.latest/checksums.sha256is a 404 today, so every install was unverified.workflow_runonbranches: [main], and theirresolve-tagjobs also require the upstream run to be in this repository, from a push or a dispatch. A fork can call its branch main, hence the repository check.latest/included, when it is already there. A concurrency group queues the tag-push and CI-completion Cross-builds for one tag instead of racing them.build.rsstampsSOURCE_DATE_EPOCH, else the HEAD commit time, never the clock. Two release builds of one commit now hash the same..sha256no longer lists itself.tests/install_sh.rsdrives the renderedinstall.shagainst a loopback HTTP server: 9 cases, and every failure path is asserted to exit 1 with nothing installed.Still open: nothing is signed, so the sums file comes from the same host as the binary. Fixing that needs a key distributed out of band, which is a separate call.
Fixes #10