Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit259df9f

Browse files
committed
feat: verify installer downloads with cosign
1 parent8eab120 commit259df9f

File tree

4 files changed

+23
-0
lines changed

4 files changed

+23
-0
lines changed

‎.github/workflows/post-release.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,4 +74,5 @@ jobs:
7474
os:[ubuntu-latest, macos-latest, windows-latest]
7575
runs-on:${{ matrix.os }}
7676
steps:
77+
-uses:sigstore/cosign-installer@v3
7778
-run:curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "./install-golangci-lint"

‎.github/workflows/pr-checks.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ jobs:
5151
os:[ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
5252
runs-on:${{ matrix.os }}
5353
steps:
54+
-uses:sigstore/cosign-installer@v3
5455
-uses:actions/checkout@v4
5556
-name:Check installation script
5657
run:cat ./install.sh | sh -s -- -d -b "./install-golangci-lint"

‎docs/src/docs/welcome/install.mdx‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/insta
5454
golangci-lint --version
5555
```
5656

57+
If[`cosign`](https://github.com/sigstore/cosign) is installed, the installer will verify downloads with it. This is highly recommended.
58+
5759
It is advised that you periodically update the version of golangci-lint as the project is under active development and is constantly being improved.
5860
For any problems with golangci-lint, check out recent[GitHub issues](https://github.com/golangci/golangci-lint/issues) and update if needed.
5961

@@ -70,6 +72,8 @@ curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install
7072
golangci-lint --version
7173
```
7274

75+
If[`cosign`](https://github.com/sigstore/cosign) is installed, the installer will verify downloads with it. This is highly recommended.
76+
7377
On Windows, you can run the above commands with Git Bash, which comes with[Git for Windows](https://git-scm.com/download/win).
7478

7579
###Linux

‎install.sh‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ execute() {
4242
log_debug"downloading files into${tmpdir}"
4343
http_download"${tmpdir}/${TARBALL}""${TARBALL_URL}"
4444
http_download"${tmpdir}/${CHECKSUM}""${CHECKSUM_URL}"
45+
cosign_verify"${tmpdir}/${CHECKSUM}"
4546
hash_sha256_verify"${tmpdir}/${TARBALL}""${tmpdir}/${CHECKSUM}"
4647
srcdir="${tmpdir}/${NAME}"
4748
rm -rf"${srcdir}"
@@ -390,6 +391,20 @@ End of functions from https://github.com/client9/shlib
390391
------------------------------------------------------------------------
391392
EOF
392393

394+
cosign_verify() {
395+
if! is_command cosign;then
396+
log_info"cosign is not available, skipping verify"
397+
return 0
398+
fi
399+
checksums=$1
400+
http_download"${tmpdir}/${CHECKSUM_COSIGN_BUNDLE}""${CHECKSUM_COSIGN_BUNDLE_URL}"
401+
cosign verify-blob \
402+
--bundle="${tmpdir}/${CHECKSUM_COSIGN_BUNDLE}" \
403+
--certificate-identity="https://github.com/$PREFIX/.github/workflows/release.yml@refs/tags/$TAG" \
404+
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
405+
"$checksums"
406+
}
407+
393408
PROJECT_NAME="golangci-lint"
394409
OWNER=golangci
395410
REPO="golangci-lint"
@@ -428,6 +443,8 @@ TARBALL=${NAME}.${FORMAT}
428443
TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
429444
CHECKSUM=${PROJECT_NAME}-${VERSION}-checksums.txt
430445
CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
446+
CHECKSUM_COSIGN_BUNDLE=${CHECKSUM}.sigstore.json
447+
CHECKSUM_COSIGN_BUNDLE_URL=${CHECKSUM_URL}.sigstore.json
431448

432449

433450
execute

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp