Copilot commented on code in PR #51326:
URL: https://github.com/apache/arrow/pull/51326#discussion_r4004486038
##########
.github/workflows/cpp.yml:
##########
@@ -408,7 +408,7 @@ jobs:
mkdir -p /usr/local/bin
wget \
--output-document /usr/local/bin/minio.exe \
-
https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2025-01-20T14-49-07Z
+
https://github.com/minio/minio/releases/download/RELEASE.2025-01-20T14-49-07Z/minio.windows-amd64.RELEASE.2025-01-20T14-49-07Z.exe
Review Comment:
Unlike the shared installer, this duplicated Windows download is not checked
against the pinned SHA-256 (`ec1bf8de…`). A replaced release asset would
therefore be accepted by this CI path even though the new installer rejects it.
Add the same checksum verification here and fail the job on mismatch.
##########
ci/docker/python-wheel-windows-test-vs2022-base.dockerfile:
##########
@@ -51,7 +51,7 @@ SHELL ["cmd", "/S", "/C"]
# Install git, wget, minio
RUN choco install --no-progress -r -y git wget
-RUN curl
https://dl.min.io/server/minio/release/windows-amd64/archive/minio.RELEASE.2025-01-20T14-49-07Z
`
+RUN curl -L
https://github.com/minio/minio/releases/download/RELEASE.2025-01-20T14-49-07Z/minio.windows-amd64.RELEASE.2025-01-20T14-49-07Z.exe
`
--output "C:\Windows\Minio.exe"
Review Comment:
This Windows image download also bypasses the checksum verification added to
`install_minio.sh`. A replaced release asset can enter the test image without
detection; verify `C:\Windows\Minio.exe` against the pinned SHA-256 before
completing this layer, and keep the check aligned with the workflow path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
