villebro opened a new pull request, #281:
URL: https://github.com/apache/superset-kubernetes-operator/pull/281
## Summary
Several build/dev tools were fetched by mutable release tag with **no
in-repo integrity pin**, diverging from the repo's established
helm/yq/oras/kind pinning standard and leaving CI, the pre-commit hook, and the
release manager's workstation exposed to a swapped upstream artifact. This
brings them all under an in-repo SHA-256 pinning model that fails closed.
## Details
- **Rat jar (`check_license.sh`).** The pinned SHA-256 was checked only at
download time, so a jar pre-planted at the fixed world-writable `/tmp/lib/...`
cache path was executed unverified. It is now verified on **every** invocation,
and cached under `${XDG_CACHE_HOME:-$HOME/.cache}` instead of `/tmp`.
- **operator-sdk, opm, rumdl (`Makefile`).** operator-sdk/opm had no
checksum; rumdl verified against a `.sha256` co-downloaded from the same origin
(self-attested). All three now verify against in-repo pins in
`hack/tool-checksums.txt` via a new fail-closed
`scripts/verify-tool-checksum.sh`; `scripts/sync-tool-checksums.sh` regenerates
them. opm's inline version is lifted to `OPM_VERSION`.
- **helm-unittest (`install-helm-unittest.sh`).** Dropped `helm plugin
install <git-url> --verify=false` (mutable tag; executes an unverified install
hook — on the release manager's workstation via `release-rc.sh`) for the pinned
release archive.
### Notes on the helm-unittest approach (vs. the original scan patch)
The scan's patch pinned a single `linux-amd64` digest and used `sha256sum`.
Because `release-rc.sh` also runs this installer on the **macOS**
release-manager workstation, that would fail there. Rather than the
single-digest `install-yq` pattern (Linux/CI-only), the installer now resolves
the host OS/arch and verifies against **per-platform** pins in the shared
`hack/tool-checksums.txt` (the verifier already falls back `sha256sum` →
`shasum`). This keeps Renovate working: it bumps `HELM_UNITTEST_VERSION` via a
version-only custom manager, and `make sync-tool-checksums` regenerates the
digests — the same model as rumdl/operator-sdk/opm.
### Drift protection
The download recipes fail closed when a pinned version has no matching
digest, so a version bump without a resync surfaces at use time in CI. A
scheduled `sync-tool-checksums.yaml` workflow additionally regenerates the pins
and opens a PR on drift (mirrors the supported-k8s auto-sync), so the pin file
cannot drift silently — without a costly per-PR re-download of the opm binaries.
## Testing
- `hack/tool-checksums.txt` regenerated via `make sync-tool-checksums`
(rumdl v0.2.55, operator-sdk v1.42.3, opm v1.55.0, helm-unittest v1.1.2 — 16
rows); helm-unittest digests cross-checked against the upstream
`helm-unittest-checksum.sha` manifest
- `bash -n` and `shellcheck -S error` clean on the new/changed scripts;
`renovate.json` and the new workflow validate as JSON/YAML
- `golangci-lint` clean (no Go changes)
---
Found via a Claude security scan. Part of a series of security follow-ups;
opened as a draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
