Skip to content

Commit f148005

Browse files
HastDHastD
authored
fix: use env vars for template expansions; show curl errors (#207)
* fix: use env vars for template expansions; show curl errors * Use environment variables to avoid template expansions in code contexts, which could potentially result in code injection. * Use `-S` option with `curl` so error output is not suppressed, which should result in more informative output when the installer fails due to network issues. * Double-quote shell variable expansions to prevent unintended word splitting and globbing. Signed-off-by: Daniel Hast <[email protected]> * fix: substitute env vars in inputs.install-dir Signed-off-by: Daniel Hast <[email protected]> --------- Signed-off-by: Daniel Hast <[email protected]>
1 parent c3f2d79 commit f148005

File tree

1 file changed

+68
-51
lines changed

1 file changed

+68
-51
lines changed

‎action.yml‎

Lines changed: 68 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,17 @@ runs:
2424
steps:
2525
# We verify the version against a SHA **in the published action itself**, not in the GCS bucket.
2626
- shell: bash
27+
env:
28+
input_cosign_release: ${{ inputs.cosign-release }}
29+
input_install_dir: ${{ inputs.install-dir }}
30+
input_use_sudo: ${{ inputs.use-sudo }}
31+
runner_arch: ${{ runner.arch }}
32+
runner_os: ${{ runner.os }}
2733
run: |
2834
#!/bin/bash
35+
# Substitute environment variables in install-dir input
36+
install_dir=$(envsubst <<<"${input_install_dir}")
37+
2938
# cosign install script
3039
shopt -s expand_aliases
3140
if [ -z "$NO_COLOR" ]; then
@@ -45,44 +54,44 @@ runs:
4554
}
4655
4756
# Check for unsupported old versions (anything below v2.0.0)
48-
if [[ "${{ inputs.cosign-release }}" != "main" ]]; then
57+
if [[ "${input_cosign_release}" != "main" ]]; then
4958
# Extract version without 'v' prefix for comparison
50-
version_num="${{ inputs.cosign-release }}"
59+
version_num="${input_cosign_release}"
5160
version_num="${version_num#v}"
5261
5362
# Check if version is less than v2.0.0
5463
if ! is_version_ge "2.0.0" "$version_num"; then
5564
log_error "cosign versions below v2.0.0 are no longer supported."
56-
log_error "Requested version: ${{ inputs.cosign-release }}"
65+
log_error "Requested version: ${input_cosign_release}"
5766
log_error "Please use cosign v2.6.0 or later."
5867
log_error "See https://github.com/sigstore/cosign/releases for available versions."
5968
exit 1
6069
fi
6170
fi
6271
63-
mkdir -p ${{ inputs.install-dir }}
72+
mkdir -p "${install_dir}"
6473
65-
if [[ ${{ inputs.cosign-release }} == "main" ]]; then
74+
if [[ "${input_cosign_release}" == "main" ]]; then
6675
log_info "installing cosign via 'go install' from its main version"
6776
GOBIN=$(go env GOPATH)/bin
6877
go install github.com/sigstore/cosign/v3/cmd/cosign@main
69-
ln -s $GOBIN/cosign ${{ inputs.install-dir}}/cosign
78+
ln -s "$GOBIN/cosign" "${install_dir}/cosign"
7079
exit 0
7180
fi
7281
7382
shaprog() {
74-
case ${{ runner.os }} in
83+
case ${runner_os} in
7584
Linux|linux)
76-
sha256sum $1 | cut -d' ' -f1
85+
sha256sum "$1" | cut -d' ' -f1
7786
;;
7887
macOS|macos)
79-
shasum -a256 $1 | cut -d' ' -f1
88+
shasum -a256 "$1" | cut -d' ' -f1
8089
;;
8190
Windows|windows)
8291
powershell -command "(Get-FileHash $1 -Algorithm SHA256 | Select-Object -ExpandProperty Hash).ToLower()"
8392
;;
8493
*)
85-
log_error "unsupported OS ${{ runner.os }}"
94+
log_error "unsupported OS ${runner_os}"
8695
exit 1
8796
;;
8897
esac
@@ -99,11 +108,11 @@ runs:
99108
100109
trap "popd >/dev/null" EXIT
101110
102-
pushd ${{ inputs.install-dir }} > /dev/null
111+
pushd "${install_dir}" > /dev/null
103112
104-
case ${{ runner.os }} in
113+
case ${runner_os} in
105114
Linux|linux)
106-
case ${{ runner.arch }} in
115+
case ${runner_arch} in
107116
X64|amd64)
108117
bootstrap_filename='cosign-linux-amd64'
109118
bootstrap_sha=${bootstrap_linux_amd64_sha}
@@ -123,14 +132,14 @@ runs:
123132
;;
124133
125134
*)
126-
log_error "unsupported architecture ${{ runner.arch }}"
135+
log_error "unsupported architecture ${runner_arch}"
127136
exit 1
128137
;;
129138
esac
130139
;;
131140
132141
macOS|macos)
133-
case ${{ runner.arch }} in
142+
case ${runner_arch} in
134143
X64|amd64)
135144
bootstrap_filename='cosign-darwin-amd64'
136145
bootstrap_sha=${bootstrap_darwin_amd64_sha}
@@ -144,115 +153,123 @@ runs:
144153
;;
145154
146155
*)
147-
log_error "unsupported architecture ${{ runner.arch }}"
156+
log_error "unsupported architecture ${runner_arch}"
148157
exit 1
149158
;;
150159
esac
151160
;;
152161
153162
Windows|windows)
154-
case ${{ runner.arch }} in
163+
case ${runner_arch} in
155164
X64|amd64)
156165
bootstrap_filename='cosign-windows-amd64.exe'
157166
bootstrap_sha=${bootstrap_windows_amd64_sha}
158167
desired_cosign_filename='cosign-windows-amd64.exe'
159168
cosign_executable_name=cosign.exe
160169
;;
161170
*)
162-
log_error "unsupported architecture ${{ runner.arch }}"
171+
log_error "unsupported architecture ${runner_arch}"
163172
exit 1
164173
;;
165174
esac
166175
;;
167176
*)
168-
log_error "unsupported os ${{ runner.os }}"
177+
log_error "unsupported os ${runner_os}"
169178
exit 1
170179
;;
171180
esac
172181
173182
SUDO=
174-
if [[ "${{ inputs.use-sudo }}" == "true" ]] && command -v sudo >/dev/null; then
183+
if [[ "${input_use_sudo}" == "true" ]] && command -v sudo >/dev/null; then
175184
SUDO=sudo
176185
fi
177186
178187
expected_bootstrap_version_digest=${bootstrap_sha}
179188
log_info "Downloading bootstrap version '${bootstrap_version}' of cosign to verify version to be installed...\n https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename}"
180-
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename} -o ${cosign_executable_name}
181-
shaBootstrap=$(shaprog ${cosign_executable_name});
182-
if [[ $shaBootstrap != ${expected_bootstrap_version_digest} ]]; then
183-
log_error "Unable to validate cosign version: '${{ inputs.cosign-release }}'"
189+
$SUDO curl -fsSL "https://github.com/sigstore/cosign/releases/download/${bootstrap_version}/${bootstrap_filename}" -o "${cosign_executable_name}"
190+
shaBootstrap=$(shaprog "${cosign_executable_name}")
191+
if [[ "$shaBootstrap" != "${expected_bootstrap_version_digest}" ]]; then
192+
log_error "Unable to validate cosign version: '${input_cosign_release}'"
184193
exit 1
185194
fi
186-
$SUDO chmod +x ${cosign_executable_name}
195+
$SUDO chmod +x "${cosign_executable_name}"
187196
188197
# If the bootstrap and specified `cosign` releases are the same, we're done.
189-
if [[ ${{ inputs.cosign-release }} == ${bootstrap_version} ]]; then
198+
if [[ "${input_cosign_release}" == "${bootstrap_version}" ]]; then
190199
log_info "bootstrap version successfully verified and matches requested version so nothing else to do"
191200
exit 0
192201
fi
193202
194203
semver='^v([0-9]+\.){0,2}(\*|[0-9]+)(-?r?c?)(\.[0-9]+)$'
195-
if [[ ${{ inputs.cosign-release }} =~ $semver ]]; then
196-
log_info "Custom cosign version '${{ inputs.cosign-release }}' requested"
204+
if [[ "${input_cosign_release}" =~ $semver ]]; then
205+
log_info "Custom cosign version '${input_cosign_release}' requested"
197206
else
198-
log_error "Unable to validate requested cosign version: '${{ inputs.cosign-release }}'"
207+
log_error "Unable to validate requested cosign version: '${input_cosign_release}'"
199208
exit 1
200209
fi
201210
202211
# Download custom cosign
203-
log_info "Downloading platform-specific version '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename}"
204-
$SUDO curl -fsL https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${desired_cosign_filename} -o cosign_${{ inputs.cosign-release }}
205-
shaCustom=$(shaprog cosign_${{ inputs.cosign-release }});
212+
log_info "Downloading platform-specific version '${input_cosign_release}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${desired_cosign_filename}"
213+
$SUDO curl -fsSL "https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${desired_cosign_filename}" -o "cosign_${input_cosign_release}"
214+
shaCustom=$(shaprog "cosign_${input_cosign_release}");
206215
207216
# same hash means it is the same release
208-
if [[ $shaCustom != $shaBootstrap ]]; then
209-
log_info "Downloading cosign public key '${{ inputs.cosign-release }}' of cosign...\n https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub"
210-
RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${{ inputs.cosign-release }}/release/release-cosign.pub
217+
if [[ "$shaCustom" != "$shaBootstrap" ]]; then
218+
log_info "Downloading cosign public key '${input_cosign_release}' of cosign...\n https://raw.githubusercontent.com/sigstore/cosign/${input_cosign_release}/release/release-cosign.pub"
219+
RELEASE_COSIGN_PUB_KEY=https://raw.githubusercontent.com/sigstore/cosign/${input_cosign_release}/release/release-cosign.pub
211220
RELEASE_COSIGN_PUB_KEY_SHA='f4cea466e5e887a45da5031757fa1d32655d83420639dc1758749b744179f126'
212221
213222
log_info "Verifying public key matches expected value"
214-
$SUDO curl -fsL $RELEASE_COSIGN_PUB_KEY -o public.key
223+
$SUDO curl -fsSL "$RELEASE_COSIGN_PUB_KEY" -o public.key
215224
sha_fetched_key=$(shaprog public.key)
216-
if [[ $sha_fetched_key != $RELEASE_COSIGN_PUB_KEY_SHA ]]; then
225+
if [[ "$sha_fetched_key" != "$RELEASE_COSIGN_PUB_KEY_SHA" ]]; then
217226
log_error "Fetched public key does not match expected digest, exiting"
218227
exit 1
219228
fi
220229
221230
if is_version_ge "3.0.1" "$version_num"; then
222231
# we're trying to get something greater than or equal to v3.0.1
223232
keyless_signature_file=${desired_cosign_filename}.sigstore.json
224-
log_info "Downloading keyless verification bundle for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${keyless_signature_file}"
225-
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${keyless_signature_file}
233+
log_info "Downloading keyless verification bundle for platform-specific '${input_cosign_release}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${keyless_signature_file}"
234+
$SUDO curl -fsSLO "https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${keyless_signature_file}"
226235
227236
log_info "Using bootstrap cosign to verify keyless signature of desired cosign version"
228-
./${cosign_executable_name} verify-blob --certificate-identity=keyless@projectsigstore.iam.gserviceaccount.com --certificate-oidc-issuer=https://accounts.google.com --bundle ${keyless_signature_file} cosign_${{ inputs.cosign-release }}
237+
"./${cosign_executable_name}" verify-blob --certificate-identity=keyless@projectsigstore.iam.gserviceaccount.com --certificate-oidc-issuer=https://accounts.google.com --bundle "${keyless_signature_file}" "cosign_${input_cosign_release}"
229238
230239
if is_version_ge "3.0.2" "$version_num"; then
231240
# we're trying to get something greater than or equal to v3.0.2
232241
kms_signature_file=${desired_cosign_filename}-kms.sigstore.json
233-
log_info "Downloading KMS verification bundle for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${kms_signature_file}"
234-
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${kms_signature_file}
242+
log_info "Downloading KMS verification bundle for platform-specific '${input_cosign_release}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${kms_signature_file}"
243+
$SUDO curl -fsSLO "https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${kms_signature_file}"
235244
236245
log_info "Using bootstrap cosign to verify signature of desired cosign version"
237-
./${cosign_executable_name} verify-blob --key public.key --bundle ${kms_signature_file} cosign_${{ inputs.cosign-release }}
246+
"./${cosign_executable_name}" verify-blob --key public.key --bundle "${kms_signature_file}" "cosign_${input_cosign_release}"
238247
fi
239248
else
240249
signature_file=${desired_cosign_filename}.sig
241-
log_info "Downloading detached signature for platform-specific '${{ inputs.cosign-release }}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${signature_file}"
242-
$SUDO curl -fsLO https://github.com/sigstore/cosign/releases/download/${{ inputs.cosign-release }}/${signature_file}
250+
log_info "Downloading detached signature for platform-specific '${input_cosign_release}' of cosign...\n https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${signature_file}"
251+
$SUDO curl -fsSLO "https://github.com/sigstore/cosign/releases/download/${input_cosign_release}/${signature_file}"
243252
244253
log_info "Using bootstrap cosign to verify signature of desired cosign version"
245-
./${cosign_executable_name} verify-blob --key public.key --signature ${signature_file} cosign_${{ inputs.cosign-release }}
254+
"./${cosign_executable_name}" verify-blob --key public.key --signature "${signature_file}" "cosign_${input_cosign_release}"
246255
fi
247256
248-
$SUDO rm ${cosign_executable_name}
249-
$SUDO mv cosign_${{ inputs.cosign-release }} ${cosign_executable_name}
250-
$SUDO chmod +x ${cosign_executable_name}
257+
$SUDO rm "${cosign_executable_name}"
258+
$SUDO mv "cosign_${input_cosign_release}" "${cosign_executable_name}"
259+
$SUDO chmod +x "${cosign_executable_name}"
251260
log_info "Installation complete!"
252261
fi
262+
253263
- if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}
254-
run: echo "${{ inputs.install-dir }}" >> $GITHUB_PATH
255264
shell: bash
265+
env:
266+
input_install_dir: ${{ inputs.install-dir }}
267+
run: envsubst <<<"${input_install_dir}" >> "$GITHUB_PATH"
268+
256269
- if: ${{ runner.os == 'Windows' }}
257-
run: echo "${{ inputs.install-dir }}" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
258270
shell: pwsh
271+
env:
272+
input_install_dir: ${{ inputs.install-dir }}
273+
run: |
274+
$install_dir = $ExecutionContext.InvokeCommand.ExpandString("${env:input_install_dir}")
275+
echo "${install_dir}" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

0 commit comments

Comments
 (0)