fix/pin-downloads #3

Merged

jfraeys merged 2 commits from fix/pin-downloads into main

2026-10-02 18:02:48 -04:00

jfraeys commented

2026-10-02 18:02:43 -04:00

Owner

No description provided.

jfraeys added 2 commits

2026-10-02 18:02:43 -04:00

fix(security): verify downloaded binaries with checksums; make docker-bench actually run ec10c76277

Binaries pinned to a version but fetched with no integrity check (a tampered
release or hijacked upstream account would go unnoticed) now carry a
SHA-256 from the vendor's published sums, each also recomputed independently
from the artifact: OpenTofu 1.12.6 (provisioner and runner roles, amd64 and
arm64), Forgejo runner 13.0.0 (runner and cache-host roles), Docker Compose
v2.27.0 fallback. Bumping a version without its checksum now fails loudly.

docker-bench-security was fetched from upstream's master with no
verification, and also never worked: the script finds functions/ and
tests/ relative to its working directory, but only the single .sh was
copied into /usr/local/sbin and the unit set no WorkingDirectory, so the
weekly scan has just logged "No such file or directory" (the download's
failed_when: false hid the rest). Now: pinned release commit (v1.6.1) with
a checksum, installed as a directory, unit runs from it. This makes a
previously dead scan start producing output on the next deploy. Stale
standalone copy is removed.

Not changed: the pipe-to-shell installers (crowdsec, trivy, nodesource,
yq), GPG keys, and authelia:latest. forgejo_runner_macos is also
untouched: its version "11" 404s on both hosts, so there's nothing valid
to checksum.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

fix(security): replace pipe-to-shell installs and pin remaining downloads by checksum 8ce6dab2dd

- crowdsec/nodesource: explicit apt repo setup with checksum-pinned keys
- yq: pinned version, per-arch sha256, curl -f
- docker/trivy/tailscale apt keys: checksum pinned
- cloud-init: pin ansible==12.3.0
- trivy scan script: no self-install from main
- macOS runner: require caller-supplied URL + sha256 (no upstream darwin build)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit fdc1871688 into main

2026-10-02 18:02:48 -04:00

jfraeys referenced this pull request from a commit

2026-10-02 18:02:49 -04:00

Merge pull request 'fix/pin-downloads' (#3) from fix/pin-downloads into main

jfraeys referenced this pull request

2026-10-13 14:25:55 -04:00

Roadmap: remaining infra and secrets work (tracker) #122

~~jfraeys referenced this pull request 2026-10-13 15:08:46 -04:00~~

Next: immediate steps (merge, deploy, verify) after the 2026-10-13 session #116

jfraeys referenced this pull request

2026-10-13 15:08:47 -04:00