Skip to content

Commit dddbfcd

Browse files
starbopsstarbops
authored
Fix/binary sha verification (#49)
* build: add checksum verification for downloaded binaries Pin versions and add SHA256 checksum verification for all binaries downloaded. Signed-off-by: Zespre Chang <zespre.chang@suse.com> * fix: ignore prealloc lint for allErrs Signed-off-by: Zespre Chang <zespre.chang@suse.com> * fix: address PR review comments on checksum verification Fix typo in Dockerfile comment, use mktemp for safe temp file handling in the Helm install target, and add shasum fallback for macOS portability. Signed-off-by: Zespre Chang <zespre.chang@suse.com> --------- Signed-off-by: Zespre Chang <zespre.chang@suse.com>
1 parent 493549b commit dddbfcd

File tree

6 files changed

+72
-14
lines changed

6 files changed

+72
-14
lines changed

‎.github/workflows/pull-request.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
- name: Run linter
2727
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
2828
with:
29-
version: v2.8.0
29+
version: v2.11.4
3030

3131
test:
3232
name: Test

‎.github/workflows/test-chart.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,19 @@ jobs:
2424
with:
2525
go-version-file: go.mod
2626

27-
- name: Install the latest version of kind
27+
- name: Install kind v0.31.0
2828
run: |
29-
curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)
29+
KIND_VERSION=v0.31.0
30+
KIND_SHA256_AMD64=eb244cbafcc157dff60cf68693c14c9a75c4e6e6fedaf9cd71c58117cb93e3fa
31+
KIND_SHA256_ARM64=8e1014e87c34901cc422a1445866835d1e666f2a61301c27e722bdeab5a1f7e4
32+
ARCH=$(go env GOARCH)
33+
case "${ARCH}" in
34+
amd64) KIND_SHA256=${KIND_SHA256_AMD64} ;;
35+
arm64) KIND_SHA256=${KIND_SHA256_ARM64} ;;
36+
*) echo "Unsupported architecture: ${ARCH}" && exit 1 ;;
37+
esac
38+
curl -Lo ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-${ARCH}"
39+
echo "${KIND_SHA256} ./kind" | sha256sum -c -
3040
chmod +x ./kind
3141
sudo mv ./kind /usr/local/bin/kind
3242

‎.github/workflows/test-e2e.yml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,19 @@ jobs:
2424
with:
2525
go-version-file: go.mod
2626

27-
- name: Install the latest version of kind
27+
- name: Install kind v0.31.0
2828
run: |
29-
curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-$(go env GOARCH)
29+
KIND_VERSION=v0.31.0
30+
KIND_SHA256_AMD64=eb244cbafcc157dff60cf68693c14c9a75c4e6e6fedaf9cd71c58117cb93e3fa
31+
KIND_SHA256_ARM64=8e1014e87c34901cc422a1445866835d1e666f2a61301c27e722bdeab5a1f7e4
32+
ARCH=$(go env GOARCH)
33+
case "${ARCH}" in
34+
amd64) KIND_SHA256=${KIND_SHA256_AMD64} ;;
35+
arm64) KIND_SHA256=${KIND_SHA256_ARM64} ;;
36+
*) echo "Unsupported architecture: ${ARCH}" && exit 1 ;;
37+
esac
38+
curl -Lo ./kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-${ARCH}"
39+
echo "${KIND_SHA256} ./kind" | sha256sum -c -
3040
chmod +x ./kind
3141
sudo mv ./kind /usr/local/bin/kind
3242

‎Dockerfile‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,39 @@ ENV KUBECTL_VERSION=v1.33.7
5555
ENV KUBEVIRT_VERSION=v1.7.1
5656
ENV YQ_VERSION=v4.52.4
5757
ENV WHARFIE_VERSION=v0.7.0
58+
59+
# SHA256 checksums for verifying downloaded binaries (per architecture)
60+
# To update: download the new binary and run `sha256sum <binary>`.
61+
# kubectl: checksums available at https://dl.k8s.io/release/<ver>/bin/linux/<arch>/kubectl.sha256
62+
# virtctl: checksums available at https://github.com/kubevirt/kubevirt/releases/tag/<ver>
63+
# yq: checksums available at https://github.com/mikefarah/yq/releases/download/<ver>/checksums
64+
# wharfie: checksums at https://github.com/rancher/wharfie/releases/download/<ver>/sha256sum-<arch>.txt
65+
ENV KUBECTL_SHA256_AMD64=471d94e208a89be62eb776700fc8206cbef11116a8de2dc06fc0086b0015375b
66+
ENV KUBECTL_SHA256_ARM64=fa7ee98fdb6fba92ae05b5e0cde0abd5972b2d9a4a084f7052a1fd0dce6bc1de
67+
ENV VIRTCTL_SHA256_AMD64=e0efcfc708067fa45232f3bab9cb2de3dbcd812d4c9aab88c727025fb213079f
68+
ENV VIRTCTL_SHA256_ARM64=7737d967bc8512abedfdaa8a61a3512f93894c12162f9dde4fab73402a4f42d5
69+
ENV YQ_SHA256_AMD64=0c4d965ea944b64b8fddaf7f27779ee3034e5693263786506ccd1c120f184e8c
70+
ENV YQ_SHA256_ARM64=4c2cc022a129be5cc1187959bb4b09bebc7fb543c5837b93001c68f97ce39a5d
71+
ENV WHARFIE_SHA256_AMD64=e5ff747b2f9f4155ce7b68917bac9dbe8a6a85727a94b0c8e6faca9252931e91
72+
ENV WHARFIE_SHA256_ARM64=b8e02fe61d4f8cb1bd7927fd5e34b49b4dcf802c52670adfaa4527ed3d9afc41
73+
5874
RUN zypper rm -y container-suseconnect && \
5975
zypper --no-gpg-checks ref && \
6076
zypper in -y curl e2fsprogs rsync awk zstd jq helm zip unzip nginx util-linux && \
6177
zypper clean -a && \
62-
curl -sfL https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl -o /usr/bin/kubectl && chmod +x /usr/bin/kubectl && \
63-
curl -sfL https://github.com/kubevirt/kubevirt/releases/download/${KUBEVIRT_VERSION}/virtctl-${KUBEVIRT_VERSION}-linux-${TARGETARCH} -o /usr/bin/virtctl && chmod +x /usr/bin/virtctl && \
64-
curl -sfL https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${TARGETARCH} -o /usr/bin/yq && chmod +x /usr/bin/yq && \
65-
curl -sfL https://github.com/rancher/wharfie/releases/download/${WHARFIE_VERSION}/wharfie-${TARGETARCH} -o /usr/bin/wharfie && chmod +x /usr/bin/wharfie
78+
case "${TARGETARCH}" in \
79+
amd64) KUBECTL_SHA256=${KUBECTL_SHA256_AMD64}; VIRTCTL_SHA256=${VIRTCTL_SHA256_AMD64}; YQ_SHA256=${YQ_SHA256_AMD64}; WHARFIE_SHA256=${WHARFIE_SHA256_AMD64} ;; \
80+
arm64) KUBECTL_SHA256=${KUBECTL_SHA256_ARM64}; VIRTCTL_SHA256=${VIRTCTL_SHA256_ARM64}; YQ_SHA256=${YQ_SHA256_ARM64}; WHARFIE_SHA256=${WHARFIE_SHA256_ARM64} ;; \
81+
*) echo "Unsupported architecture: ${TARGETARCH}" && exit 1 ;; \
82+
esac && \
83+
curl -sfL https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl -o /usr/bin/kubectl && \
84+
echo "${KUBECTL_SHA256} /usr/bin/kubectl" | sha256sum -c - && chmod +x /usr/bin/kubectl && \
85+
curl -sfL https://github.com/kubevirt/kubevirt/releases/download/${KUBEVIRT_VERSION}/virtctl-${KUBEVIRT_VERSION}-linux-${TARGETARCH} -o /usr/bin/virtctl && \
86+
echo "${VIRTCTL_SHA256} /usr/bin/virtctl" | sha256sum -c - && chmod +x /usr/bin/virtctl && \
87+
curl -sfL https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_${TARGETARCH} -o /usr/bin/yq && \
88+
echo "${YQ_SHA256} /usr/bin/yq" | sha256sum -c - && chmod +x /usr/bin/yq && \
89+
curl -sfL https://github.com/rancher/wharfie/releases/download/${WHARFIE_VERSION}/wharfie-${TARGETARCH} -o /usr/bin/wharfie && \
90+
echo "${WHARFIE_SHA256} /usr/bin/wharfie" | sha256sum -c - && chmod +x /usr/bin/wharfie
6691

6792
RUN useradd -r -u 1000 -U -s /sbin/nologin -d /nonexistent upgrade-toolkit
6893

‎Makefile‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,7 @@ CONTROLLER_TOOLS_VERSION ?= v0.18.0
217217
ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller-runtime | awk -F'[v.]' '{printf "release-%d.%d", $$2, $$3}')
218218
#ENVTEST_K8S_VERSION is the version of Kubernetes to use for setting up ENVTEST binaries (i.e. 1.31)
219219
ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
220-
GOLANGCI_LINT_VERSION ?= v2.8.0
220+
GOLANGCI_LINT_VERSION ?= v2.11.4
221221

222222
.PHONY: kustomize
223223
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -280,11 +280,24 @@ HELM_EXTRA_ARGS ?=
280280
install-external-crds: ## Install external stub CRDs required by Kind-based CI tests.
281281
kubectl apply -f hack/external-stub-crds.yaml
282282

283+
HELM_INSTALL_SCRIPT_SHA ?= 5ae85868d45ca7bb9ac3ef7a10e0db54b8a8695c
284+
HELM_INSTALL_SCRIPT_CHECKSUM ?= b68c5f694cff19f14ee8a5784ffd3de27fa7034ec8f973d703fc6fb85496ced7
285+
283286
.PHONY: install-helm
284-
install-helm: ## Install the latest version of Helm.
287+
install-helm: ## Install Helm using a pinned installer script.
285288
@command -v $(HELM) >/dev/null 2>&1 || { \
286289
echo "Installing Helm..." && \
287-
curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-4 | bash; \
290+
tmp_script=$$(mktemp) && \
291+
trap 'rm -f $$tmp_script' EXIT INT HUP TERM && \
292+
curl -fsSL "https://raw.githubusercontent.com/helm/helm/$(HELM_INSTALL_SCRIPT_SHA)/scripts/get-helm-4" -o $$tmp_script && \
293+
if command -v sha256sum >/dev/null 2>&1; then \
294+
echo "$(HELM_INSTALL_SCRIPT_CHECKSUM) $$tmp_script" | sha256sum -c -; \
295+
elif command -v shasum >/dev/null 2>&1; then \
296+
echo "$(HELM_INSTALL_SCRIPT_CHECKSUM) $$tmp_script" | shasum -a 256 -c -; \
297+
else \
298+
echo "WARNING: no sha256sum or shasum found, skipping checksum verification" >&2; \
299+
fi && \
300+
bash $$tmp_script; \
288301
}
289302

290303
.PHONY: helm-deploy

‎internal/webhook/v1beta1/upgradeplan_webhook.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ func (v *UpgradePlanCustomValidator) ValidateCreate(ctx context.Context, obj run
102102
return nil, nil
103103
}
104104

105-
var allErrs field.ErrorList
105+
var allErrs field.ErrorList //nolint:prealloc // each validator returns variable-length errors
106106

107107
allErrs = append(allErrs, validateVersionExists(ctx, v.Client, upgradePlan)...)
108108
allErrs = append(allErrs, validateNoConcurrentUpgrade(ctx, v.Client, upgradePlan.Name)...)
@@ -137,7 +137,7 @@ func (v *UpgradePlanCustomValidator) ValidateUpdate(ctx context.Context, _, newO
137137
}
138138
upgradeplanlog.Info("Validation for UpgradePlan upon update", "name", newUpgradePlan.GetName())
139139

140-
var allErrs field.ErrorList
140+
var allErrs field.ErrorList //nolint:prealloc // each validator returns variable-length errors
141141

142142
allErrs = append(allErrs, validateNodeUpgradeOption(ctx, v.Client, newUpgradePlan)...)
143143

0 commit comments

Comments
 (0)