From ca58dd0ce3acb4e4bd85f1dfd2f3fef9ebcf32a0 Mon Sep 17 00:00:00 2001 From: Andrea Lorenzetti Date: Sat, 15 Aug 2026 05:21:31 +0200 Subject: [PATCH] feat(security): verify drone-ssh binary checksum after download (#410) * Verify drone-ssh binary checksum after download Download checksums.txt from the drone-ssh release alongside the binary and verify it. Protects against tampered or corrupted release artifacts. * refactor: make checksum verification portable across minimal containers - Detect shasum (Perl) or sha256sum (coreutils/busybox) and fall back gracefully; warn and skip verification only when neither tool exists, so container jobs without perl are not broken - Look up the exact checksums.txt entry for the target binary and compare hashes directly, avoiding the --ignore-missing flag that busybox sha256sum does not support - Fail closed when checksums.txt has no entry for the binary - Remove checksums.txt after successful verification Co-Authored-By: Claude Fable 5 --------- Co-authored-by: Bo-Yi Wu Co-authored-by: Claude Fable 5 --- entrypoint.sh | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/entrypoint.sh b/entrypoint.sh index 123c26d..6658fac 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -62,6 +62,37 @@ else log_error "Downloaded file is missing or empty: ${TARGET}" "${ERR_INVALID_BINARY}" fi + # Verify checksum; container jobs may lack shasum (Perl) or sha256sum, so + # detect an available tool and skip verification with a warning if none exists + SHA256_CMD="" + if command -v shasum >/dev/null 2>&1; then + SHA256_CMD="shasum -a 256" + elif command -v sha256sum >/dev/null 2>&1; then + SHA256_CMD="sha256sum" + else + echo "Warning: neither shasum nor sha256sum is available, skipping checksum verification" >&2 + fi + + if [[ -n "${SHA256_CMD}" ]]; then + CHECKSUMS_FILE="${GITHUB_ACTION_PATH}/checksums.txt" + if ! curl -fsSL --retry 5 --keepalive-time 2 --location ${INSECURE_OPTION} \ + "${DOWNLOAD_URL_PREFIX}/checksums.txt" -o "${CHECKSUMS_FILE}"; then + log_error "Failed to download checksums.txt from ${DOWNLOAD_URL_PREFIX}." "${ERR_DOWNLOAD_FAILED}" + fi + + EXPECTED_CHECKSUM=$(awk -v bin="${CLIENT_BINARY}" '$2 == bin {print $1}' "${CHECKSUMS_FILE}") + if [[ -z "${EXPECTED_CHECKSUM}" ]]; then + log_error "No checksum entry found for ${CLIENT_BINARY} in checksums.txt." "${ERR_INVALID_BINARY}" + fi + + ACTUAL_CHECKSUM=$(${SHA256_CMD} "${TARGET}" | awk '{print $1}') + if [[ "${ACTUAL_CHECKSUM}" != "${EXPECTED_CHECKSUM}" ]]; then + log_error "Checksum verification failed for ${CLIENT_BINARY}: expected ${EXPECTED_CHECKSUM}, got ${ACTUAL_CHECKSUM}." "${ERR_INVALID_BINARY}" + fi + echo "Checksum verification passed for ${CLIENT_BINARY}" + rm -f "${CHECKSUMS_FILE}" + fi + chmod +x "${TARGET}" fi