feat(security): verify integrity of helper binaries#35
Merged
eve-rf merged 4 commits intorapidfort:mainfrom Jan 23, 2026
Merged
feat(security): verify integrity of helper binaries#35eve-rf merged 4 commits intorapidfort:mainfrom
eve-rf merged 4 commits intorapidfort:mainfrom
Conversation
When using `curl` to pull in assets, you should always verify available checksums before using the assets to help protect against supply chain compromises
use the SHA256 checksums for the ECR binary to verify their integrity and harden the supply chain
eve-rf
reviewed
Dec 22, 2025
Sort apk pkgs and correct line continuation
eve-rf
approved these changes
Jan 23, 2026
Contributor
|
Thank you for the PR! Approved and merged. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
apk addpackages for readabilityIdeally, I would move the installing of these helpers into their own layer(s) and simply add another
COPY --from=helpersto the final phase. This increases parallelism during builds, improves caching (maybe) and cleans up the final phase making is easier to read. But that can be another PR later ;)