Skip to content

fix: use pinned versions and checksum validation #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brandboat merged 1 commit into from
Mar 31, 2026
Merged

fix: use pinned versions and checksum validation #117

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions Dockerfile.dapper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,12 @@ ARG DAPPER_HOST_ARCH
ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}

RUN zypper -n rm container-suseconnect && \
zypper -n install git curl docker gzip tar wget awk
zypper -n install git curl docker gzip tar wget awk docker-buildx

## install golangci
RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s latest
RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.11.4
## install controller-gen
RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.18.0
# The docker version in dapper is too old to have buildx. Install it manually.
RUN curl -sSfL https://github.com/docker/buildx/releases/download/v0.13.1/buildx-v0.13.1.linux-${ARCH} -o buildx-v0.13.1.linux-${ARCH} && \
chmod +x buildx-v0.13.1.linux-${ARCH} && \
mv buildx-v0.13.1.linux-${ARCH} /usr/local/bin/buildx

# install openapi-gen
RUN go install k8s.io/code-generator/cmd/openapi-gen@v0.29.13
Expand Down
13 changes: 12 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,19 @@
TARGETS := $(shell ls scripts)

SHA512SUM_Linux_aarch64 := 781951b31e5ff018a04e755c6da7163b31a81edda61f1bed4def8d0e24229865c58a3d26aa0cc4184058d91ebcae300ead2cad16d3c46ccb1098419e3e41a016
SHA512SUM_Linux_x86_64 := d2ec27ecf9362e2fafd27d76d85a5c5b92b53aefe07cffa76bf9887db6bee07b1023cca8fc32a2c9bdd2ecfadaee71397066b41bd37c9ebbbbce09913f0884d4
SHA512SUM_Darwin_arm64 := 8a356c89ad32af1698ae8615a6e303773a8ac58b114368454d59965ec2aa8282e780d1e228d37c301ce6f87596f68bfe7f204eb5f4c019c386a58dd94153ddcf
SHA512SUM_Darwin_x86_64 := dbab05de04dda26793f4ae7875d0fba96ee54b0228e192fd40c0b2116ed345b5444047fc2e0c90cb481f28cbe0e0452bcecb268c8d074cd8615eb2f5463c30b6
SHA512SUM_Windows_x86_64 := 807aee2f68b6da35cb0885558f5cbc9a6c8747a56c7a200f0e1fcac9e2fd0da570cbb39e48b3192bd1a71805f2ab38fd19d77faebba97a89e5d9a8b430ee429e

.dapper:
@echo Downloading dapper
@curl -sL https://releases.rancher.com/dapper/latest/dapper-$$(uname -s)-$$(uname -m) > .dapper.tmp
@curl -sL https://releases.rancher.com/dapper/v0.6.0/dapper-`uname -s`-`uname -m` > .dapper.tmp
@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The checksum calculation relies on shasum -a 512, which isn't available by default on many Linux distributions (while sha512sum typically is). Consider using sha512sum or adding a small fallback that prefers sha512sum and falls back to shasum when present, to avoid make .dapper failing on systems without shasum.

Suggested change
@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \
@CHECKSUM_CMD=$$(command -v sha512sum || command -v shasum); \
if [ -z "$$CHECKSUM_CMD" ]; then \
echo "No suitable sha512 checksum tool found (tried: sha512sum, shasum)"; \
exit 1; \
fi; \
if echo "$$CHECKSUM_CMD" | grep -q shasum; then \
CHECKSUM=$$($$CHECKSUM_CMD -a 512 .dapper.tmp | awk '{print $$1}'); \
else \
CHECKSUM=$$($$CHECKSUM_CMD .dapper.tmp | awk '{print $$1}'); \
fi; \

Copilot uses AI. Check for mistakes.
if [ "$$CHECKSUM" != "$(SHA512SUM_$(shell uname -s)_$(shell uname -m))" ]; then \
Comment on lines +11 to +13

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If uname -s / uname -m doesn't match one of the defined SHA512SUM_* variables, the expected checksum expands to an empty string and the target fails with a generic "Checksum verification failed" message. It would be more actionable to detect an empty expected checksum and print an explicit "unsupported OS/arch" error (or list supported combinations).

Suggested change
@curl -sL https://releases.rancher.com/dapper/v0.6.0/dapper-`uname -s`-`uname -m` > .dapper.tmp
@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \
if [ "$$CHECKSUM" != "$(SHA512SUM_$(shell uname -s)_$(shell uname -m))" ]; then \
@curl -sL https://releases.rancher.com/dapper/v0.6.0/dapper-`uname -s`-`uname - m` > .dapper.tmp
@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \
EXPECTED="$(SHA512SUM_$(shell uname -s)_$(shell uname -m))"; \
if [ -z "$$EXPECTED" ]; then \
echo "Unsupported OS/arch: `uname -s`-`uname -m`."; \
echo "Supported combinations: Linux-aarch64, Linux-x86_64, Darwin-arm64, Darwin-x86_64, Windows-x86_64."; \
exit 1; \
fi; \
if [ "$$CHECKSUM" != "$$EXPECTED" ]; then \

Copilot uses AI. Check for mistakes.
echo "Checksum verification failed!"; \
exit 1; \
fi
@@chmod +x .dapper.tmp

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The recipe line uses @@chmod, which will attempt to run a command literally named @chmod (extra @ becomes part of the command) and will fail. This should be a single @chmod to mark the file executable.

Suggested change
@@chmod +x .dapper.tmp
@chmod +x .dapper.tmp

Copilot uses AI. Check for mistakes.
@./.dapper.tmp -v
@mv .dapper.tmp .dapper
Expand Down
7 changes: 5 additions & 2 deletions ci/helper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,11 @@ export KUBECONFIG=$VAGRANT_RANCHERD_DIR/kubeconfig

if [[ $(ensure_command helm) -eq 1 ]]; then
echo "no helm, try to curl..."
curl -O https://get.helm.sh/helm-v3.9.4-linux-amd64.tar.gz
tar -zxvf helm-v3.9.4-linux-amd64.tar.gz
HELM_VERSION=3.9.4
HELM_SUM_AMD64=31960ff2f76a7379d9bac526ddf889fb79241191f1dbe2a24f7864ddcb3f6560
curl --output /tmp/helm.tar.gz -sLf "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" && \
echo "${HELM_SUM_AMD64} /tmp/helm.tar.gz" | sha256sum -c - && \
tar -xvzf /tmp/helm.tar.gz -C $TOP_DIR
HELM=$TOP_DIR/linux-amd64/helm
$HELM version
Comment on lines +45 to 49

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Helm download is hard-coded to the linux-amd64 tarball and only defines an AMD64 checksum. The repo's GitHub Actions uses a self-hosted runner without an explicit architecture constraint, so this can break on arm64 runners (and the checksum would be wrong). Consider deriving OS/arch from uname and selecting the correct artifact + checksum (or failing fast with a clear message when unsupported).

Suggested change
curl --output /tmp/helm.tar.gz -sLf "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" && \
echo "${HELM_SUM_AMD64} /tmp/helm.tar.gz" | sha256sum -c - && \
tar -xvzf /tmp/helm.tar.gz -C $TOP_DIR
HELM=$TOP_DIR/linux-amd64/helm
$HELM version
# Detect OS and architecture for Helm download
HELM_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
case "${HELM_OS}" in
linux)
;;
*)
echo "Unsupported OS for Helm installation: ${HELM_OS}. Only linux is supported."
exit 1
;;
esac
HELM_ARCH_RAW=$(uname -m)
case "${HELM_ARCH_RAW}" in
x86_64)
HELM_ARCH=amd64
;;
aarch64|arm64)
HELM_ARCH=arm64
;;
*)
echo "Unsupported architecture for Helm installation: ${HELM_ARCH_RAW}. Supported: x86_64, arm64/aarch64."
exit 1
;;
esac
HELM_TARBALL="/tmp/helm.tar.gz"
HELM_TARBALL_NAME="helm-v${HELM_VERSION}-${HELM_OS}-${HELM_ARCH}.tar.gz"
HELM_URL="https://get.helm.sh/${HELM_TARBALL_NAME}"
echo "Downloading Helm from ${HELM_URL} for ${HELM_OS}-${HELM_ARCH}..."
curl --output "${HELM_TARBALL}" -sLf "${HELM_URL}"
if [ "${HELM_ARCH}" = "amd64" ]; then
echo "${HELM_SUM_AMD64} ${HELM_TARBALL}" | sha256sum -c -
else
echo "Warning: skipping checksum verification for Helm on architecture ${HELM_ARCH}."
fi
tar -xvzf "${HELM_TARBALL}" -C "${TOP_DIR}"
HELM="${TOP_DIR}/${HELM_OS}-${HELM_ARCH}/helm"
"${HELM}" version

Copilot uses AI. Check for mistakes.
else
Expand Down
2 changes: 1 addition & 1 deletion scripts/package
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ if [[ -n ${BUILD_FOR_CI} ]]; then
fi
DOCKERFILE=package/Dockerfile

buildx build --load \
docker buildx build --load \
-f ${DOCKERFILE} -t ${IMAGE} .
echo Built ${IMAGE}

Expand Down
2 changes: 1 addition & 1 deletion scripts/package-webhook
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ if [[ -n ${BUILD_FOR_CI} ]]; then
fi
DOCKERFILE=package/Dockerfile.webhook

buildx build --load \
docker buildx build --load \
-f ${DOCKERFILE} -t ${IMAGE} .
echo Built ${IMAGE}
Comment on lines +14 to 16

Copilot AI Mar 30, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This script doesn't enable set -e (unlike scripts/package). If docker buildx build fails, the script can still print Built ... and (when BUILD_FOR_CI is unset) exit successfully without producing an image. Consider adding set -e (or checking the build command exit code) so failures are surfaced reliably.

Copilot uses AI. Check for mistakes.

Expand Down
Loading