fix: 🔒️ SHA256-verify goreleaser+syft, drop piped install.sh #159

Merged

goern merged 0 commits from refs/pull/159/head into main 2026-05-25 22:43:45 +00:00

Conversation 4 Commits - Files changed -

goern commented 2026-05-25 22:42:28 +00:00 (Migrated from codeberg.org)

Copy link

Summary

Hardens supply-chain pinning for two tools in the release-tools image that had no integrity verification:

• goreleaser: was go install github.com/goreleaser/goreleaser/v2@v2.16.0 — re-resolves the full transitive dependency graph from proxy.golang.org on every image build. A transitive dep takeover would ship unnoticed. Now: downloads prebuilt goreleaser_Linux_x86_64.tar.gz and SHA256-verifies against both the recorded VERSIONS.md hash and the publisher's checksums.txt.

• syft: was curl install.sh | sh — piped-script antipattern with no integrity control. Now: downloads prebuilt syft_N.N.N_linux_amd64.tar.gz and SHA256-verifies the same way.

Both expected SHA256 hashes are recorded in VERSIONS.md as the single source of truth. On version bumps, update VERSIONS.md + the corresponding ARG *_SHA256 default in Containerfile together.

cosign verification was already correct and is unchanged.

Verification pattern (dual check)

Both tools use the same pattern:

1. Verify the downloaded file matches the hash recorded in this repo (VERSIONS.md / Containerfile ARG)
2. Verify the downloaded file matches the hash in the publisher's own checksums.txt

If either check fails, the build fails before any binary reaches /usr/local/bin.

Closes forgejo-mcp-3h2

## Summary Hardens supply-chain pinning for two tools in the release-tools image that had no integrity verification: - **goreleaser**: was `go install github.com/goreleaser/goreleaser/v2@v2.16.0` — re-resolves the full transitive dependency graph from proxy.golang.org on every image build. A transitive dep takeover would ship unnoticed. Now: downloads prebuilt `goreleaser_Linux_x86_64.tar.gz` and SHA256-verifies against both the recorded `VERSIONS.md` hash and the publisher's `checksums.txt`. - **syft**: was `curl install.sh | sh` — piped-script antipattern with no integrity control. Now: downloads prebuilt `syft_N.N.N_linux_amd64.tar.gz` and SHA256-verifies the same way. Both expected SHA256 hashes are recorded in `VERSIONS.md` as the single source of truth. On version bumps, update `VERSIONS.md` + the corresponding `ARG *_SHA256` default in `Containerfile` together. cosign verification was already correct and is unchanged. ## Verification pattern (dual check) Both tools use the same pattern: 1. Verify the downloaded file matches the hash recorded in this repo (`VERSIONS.md` / Containerfile ARG) 2. Verify the downloaded file matches the hash in the publisher's own `checksums.txt` If either check fails, the build fails before any binary reaches `/usr/local/bin`. Closes forgejo-mcp-3h2

op1st-gitops commented 2026-05-25 22:42:30 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-57br8 is running.

Starting Pipelinerun on-pull-request-57br8 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-57br8 -f

op1st Pipelines as Code/on-pull-request-57br8 is running. Starting Pipelinerun <b>[on-pull-request-57br8](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-57br8)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-57br8) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-57br8 -f</code>

op1st-gitops commented 2026-05-25 22:42:30 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-glvr6 is running.

Starting Pipelinerun code-scans-glvr6 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-glvr6 -f

op1st Pipelines as Code/code-scans-glvr6 is running. Starting Pipelinerun <b>[code-scans-glvr6](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-glvr6)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-glvr6) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-glvr6 -f</code>

op1st-gitops commented 2026-05-25 22:42:53 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/code-scans-glvr6 has successfully validated your commit.

• Namespace: op1st-pipelines
• PipelineRun: code-scans-glvr6

---

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	fetch-source
Succeeded	8 seconds	gitleaks-version
Succeeded	10 seconds	gitleaks

op1st Pipelines as Code/code-scans-glvr6 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-glvr6">code-scans-glvr6</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-glvr6/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>8 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-glvr6/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-glvr6/logs/gitleaks) </td></tr> </table>

op1st-gitops commented 2026-05-25 22:43:48 +00:00 (Migrated from codeberg.org)

Copy link

op1st Pipelines as Code/on-pull-request-57br8

• Namespace: op1st-pipelines
• PipelineRun: on-pull-request-57br8

---

Task Statuses:

Status	Duration	Name
Succeeded	10 seconds	fetch-source
Failed	1 minute	build-and-test

---

Failure snippet:

task build-and-test has the status "TaskRunCancelled":

TaskRun "on-pull-request-57br8-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.

op1st Pipelines as Code/on-pull-request-57br8 <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-57br8">on-pull-request-57br8</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-57br8/logs/fetch-source) </td></tr> <tr> <td>Failed</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-57br8/logs/build-and-test) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>build-and-test</b> has the status <b>"TaskRunCancelled"</b>: <pre>TaskRun "on-pull-request-57br8-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.</pre>

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

Compat/Breaking

Breaking change that won't be backward compatible

  

Kind/Bug

Something is not working

  

Kind/Documentation

Documentation changes

  

Kind/Enhancement

Improve existing functionality

  

Kind/Feature

New functionality

  

Kind/OpenSpec

OpenSpec change proposal / spec-driven work

  

Kind/Security

This is security issue

  

Kind/Testing

Issue or pull request related to testing

  

Priority/Critical

The priority is critical

  

Priority/High

The priority is high

  

Priority/Low

The priority is low

  

Priority/Medium

The priority is medium

  

RFC - Request For Comments

Request For Comments — design/spec open for feedback before implementation

  

Reviewed/Confirmed

Issue has been confirmed

  

Reviewed/Duplicate

This issue or pull request already exists

  

Reviewed/Invalid

Invalid issue

  

Reviewed/Won't Fix

This issue won't be fixed

  

Status/Abandoned

Somebody has started to work on this but abandoned work

  

Status/Blocked

Something is blocking this issue or pull request

  

Status/Need More Info

Feedback is required to reproduce issue or to continue work

  

hermes-attempted

Hermes attempted but produced no changes

  

hermes-needs-clarification

Quality gate flagged, needs human input

  

hermes-ready

Ready for hermes to process

  

hermes-review

Hermes PR awaiting review

  

hermes-wip

Hermes is working on this

  

human-required

Hermes gave up after 3 attempts

No labels

Compat/Breaking

Kind/Bug

Kind/Documentation

Kind/Enhancement

Kind/Feature

Kind/OpenSpec

Kind/Security

Kind/Testing

Priority/Critical

Priority/High

Priority/Low

Priority/Medium

RFC - Request For Comments

Reviewed/Confirmed

Reviewed/Duplicate

Reviewed/Invalid

Reviewed/Won't Fix

Status/Abandoned

Status/Blocked

Status/Need More Info

hermes-attempted

hermes-needs-clarification

hermes-ready

hermes-review

hermes-wip

human-required

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!159

No description provided.