Skip to content

Commit 8b483e7

Browse files
anthony-nhsanthony-nhs
committed
verify installs
1 parent 7ff1d37 commit 8b483e7

19 files changed

Lines changed: 294 additions & 110 deletions

File tree

‎.github/workflows/build_all_images.yml‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,9 @@ jobs:
3737
3838
build_tool_images:
3939
# build common tool images with a lower scoped github token
40-
# as it uses a 3rd party docker image with github cli installed to verify attestation of tflint binary
41-
# and we dont want to make a high scoped token available to that image
42-
# token needs attestation read so it can verify attestation of tflint binary
40+
# as it uses a 3rd party docker image with github cli installed to verify attestation of binaries downloaded from github
41+
# and we don't want to make a high scoped token available to that image
42+
# token needs attestation read so it can verify attestation of binaries
4343
name: Build tool images for on ${{ matrix.arch }}
4444
runs-on: '${{ matrix.runner }}'
4545
strategy:
@@ -59,23 +59,14 @@ jobs:
5959
with:
6060
fetch-depth: 0
6161
persist-credentials: false
62-
- name: build_grype
62+
- name: build_tools
6363
run: |
64-
make build-grype
64+
make build-tools
6565
docker save "local_grype:latest" -o grype_image.tar
66-
- name: build_syft
67-
run: |
68-
make build-syft
6966
docker save "local_syft:latest" -o syft_image.tar
70-
- name: build_grant
71-
run: |
72-
make build-grant
7367
docker save "local_grant:latest" -o grant_image.tar
74-
75-
- name: build_tflint
76-
run: |
77-
make build-tflint
7868
docker save "local_tflint:latest" -o tflint_image.tar
69+
docker save "local_zizmor:latest" -o zizmor_image.tar
7970
env:
8071
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8172

‎Makefile‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,11 +91,24 @@ build-tflint:
9191
else \
9292
docker buildx build \
9393
--secret id=GH_TOKEN,env=GITHUB_TOKEN \
94-
-f src/projects/eps-storage-terraform/.devcontainer/Dockerfile.tflint \
94+
-f src/base/.devcontainer/Dockerfile.tflint \
9595
--tag local_tflint:latest \
96-
src/projects/eps-storage-terraform/.devcontainer/; \
96+
src/base/.devcontainer/; \
9797
fi
9898

99+
build-zizmor:
100+
@if docker image inspect local_zizmor:latest >/dev/null 2>&1; then \
101+
echo "Image local_zizmor:latest already exists. Skipping build."; \
102+
else \
103+
docker buildx build \
104+
--secret id=GH_TOKEN,env=GITHUB_TOKEN \
105+
-f src/base/.devcontainer/Dockerfile.zizmor \
106+
--tag local_zizmor:latest \
107+
src/base/.devcontainer/; \
108+
fi
109+
110+
build-tools: build-syft build-grype build-grant build-tflint build-zizmor
111+
99112
build-image: build-syft build-grype build-grant build-tflint guard-CONTAINER_NAME guard-BASE_VERSION_TAG guard-BASE_FOLDER guard-IMAGE_TAG
100113
workspace_folder="$${CONTAINER_NAME}"; \
101114
case "$${CONTAINER_NAME}" in \

‎src/base/.devcontainer/Dockerfile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,24 @@
11
FROM local_syft:latest AS syft-build
22
FROM local_grype:latest AS grype-build
33
FROM local_grant:latest AS grant-build
4+
FROM local_zizmor:latest AS zizmor-build
45
FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
56

67
ARG SCRIPTS_DIR=/usr/local/share/eps
78
ARG CONTAINER_NAME
89
ARG IMAGE_TAG
910
ARG TARGETARCH
11+
ARG SAM_VERSION="v1.158.0"
1012

1113
ENV SCRIPTS_DIR=${SCRIPTS_DIR}
1214
ENV CONTAINER_NAME=${CONTAINER_NAME}
1315
ENV TARGETARCH=${TARGETARCH}
16+
ENV SAM_VERSION=${SAM_VERSION}
1417

1518
COPY .tool-versions.asdf ${SCRIPTS_DIR}/${CONTAINER_NAME}/.tool-versions.asdf
1619
COPY --chmod=755 scripts/lifecycle/*.sh ${SCRIPTS_DIR}/
1720
COPY --chmod=755 scripts/root_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/root_install.sh
21+
COPY --chmod=755 scripts/install_aws_sam_cli.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/install_aws_sam_cli.sh
1822
COPY --chmod=755 Mk ${SCRIPTS_DIR}/Mk
1923

2024
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
@@ -23,7 +27,7 @@ RUN ./root_install.sh
2327
COPY --from=syft-build /syft /usr/local/bin/syft
2428
COPY --from=grype-build /grype /usr/local/bin/grype
2529
COPY --from=grant-build /grant /usr/local/bin/grant
26-
30+
COPY --from=zizmor-build /zizmor /usr/local/bin/zizmor
2731
COPY --chmod=755 scripts/vscode_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/vscode_install.sh
2832
USER vscode
2933
COPY --chown=vscode:vscode .tool-versions.asdf /home/vscode/.tool-versions.asdf

‎src/base/.devcontainer/Dockerfile.tflint‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
FROM serversideup/github-cli:2.89.0 AS build
2+
ARG TARGETARCH
3+
ARG TFLINT_VERSION="v0.61.0"
4+
COPY --chmod=755 scripts/install_github_release.sh /tmp/install_github_release.sh
5+
RUN --mount=type=secret,id=GH_TOKEN,env=GH_TOKEN \
6+
case "${TARGETARCH}" in \
7+
x86_64|amd64) DOWNLOAD_BINARY=tflint_linux_amd64.zip ;; \
8+
aarch64|arm64) DOWNLOAD_BINARY=tflint_linux_arm64.zip ;; \
9+
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
10+
esac \
11+
&& INSTALL_DIR=/tmp/tflint/ \
12+
ARCH="${TARGETARCH}" \
13+
VERSION="${TFLINT_VERSION}" \
14+
GITHUB_REPO="terraform-linters/tflint" \
15+
TOOL="tflint" \
16+
DOWNLOAD_BINARY="${DOWNLOAD_BINARY}" \
17+
VERIFY_BINARY_ATTESTATION="false" \
18+
VERIFY_CHECKSUM="true" \
19+
COMPRESSION="zip" \
20+
/tmp/install_github_release.sh
21+
22+
FROM scratch
23+
COPY --from=build /tmp/tflint/tflint /tflint
24+
ENTRYPOINT ["/tflint"]

‎src/base/.devcontainer/Dockerfile.zizmor‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
FROM serversideup/github-cli:2.89.0 AS build
2+
ARG TARGETARCH
3+
ARG ZIZMOR_VERSION="v1.24.1"
4+
COPY --chmod=755 scripts/install_github_release.sh /tmp/install_github_release.sh
5+
RUN --mount=type=secret,id=GH_TOKEN,env=GH_TOKEN \
6+
case "${TARGETARCH}" in \
7+
x86_64|amd64) DOWNLOAD_BINARY=zizmor-x86_64-unknown-linux-gnu.tar.gz ;; \
8+
aarch64|arm64) DOWNLOAD_BINARY=zizmor-aarch64-unknown-linux-gnu.tar.gz ;; \
9+
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
10+
esac \
11+
&& INSTALL_DIR=/tmp/zizmor/ \
12+
ARCH="${TARGETARCH}" \
13+
VERSION="${ZIZMOR_VERSION}" \
14+
GITHUB_REPO="zizmorcore/zizmor" \
15+
TOOL="zizmor" \
16+
DOWNLOAD_BINARY="${DOWNLOAD_BINARY}" \
17+
VERIFY_BINARY_ATTESTATION="true" \
18+
VERIFY_CHECKSUM="false" \
19+
COMPRESSION="tar.gz" \
20+
/tmp/install_github_release.sh
21+
22+
FROM scratch
23+
COPY --from=build /tmp/zizmor/zizmor /zizmor
24+
ENTRYPOINT ["/zizmor"]

‎src/base/.devcontainer/devcontainer.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@
2121
"moby": "true",
2222
"installDockerBuildx": "true"
2323
},
24+
// fine to use github-cli feature here as it verifies the installation
2425
"ghcr.io/devcontainers/features/github-cli:1": {},
26+
// fine to use aws-cli feature here as it verifies the installation
2527
"ghcr.io/devcontainers/features/aws-cli:1": {
2628
"version": "latest"
2729
}

‎src/base/.devcontainer/scripts/install_aws_sam_cli.sh‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
5+
VERSION=${VERSION:-"latest"}
6+
VERBOSE=${VERBOSE:-"true"}
7+
8+
PRIMARY_PUBLIC_KEY="-----BEGIN PGP PUBLIC KEY BLOCK-----
9+
Version: GnuPG v2.0.22 (GNU/Linux)
10+
11+
mQINBGRuSzMBEADsqiwOy78w7F4+sshaMFRIwRGNRm94p5Qey2KMZBxekFtoryVD
12+
D9jEOnvupx4tvhfBHz5EcUHCEOdl4MTqdBy6vVAshozgxVb9RE8JpECn5lw7XC69
13+
4Y7Gy1TKKQMEWtDXElkGxIFdUWvWjSnPlzfnoXwQYGeE93CUS3h5dImP22Yk1Ct6
14+
eGGhlcbg1X4L8EpFMj7GvcsU8f7ziVI/PyC1Xwy39Q8/I67ip5eU5ddxO/xHqrbL
15+
YC7+8pJPbRMej2twT2LrcpWWYAbprMtRoa6WfE0/thoo3xhHpIMHdPfAA86ZNGIN
16+
kRLjGUg7jnPTRW4Oin3pCc8nT4Tfc1QERkHm641gTC/jUvpmQsM6h/FUVP2i5iE/
17+
JHpJcMuL2Mg6zDo3x+3gTCf+Wqz3rZzxB+wQT3yryZs6efcQy7nROiRxYBxCSXX0
18+
2cNYzsYLb/bYaW8yqWIHD5IqKhw269gp2E5Khs60zgS3CorMb5/xHgXjUCVgcu8a
19+
a8ncdf9fjl3WS5p0ohetPbO2ZjWv+MaqrZOmUIgKbA4RpWZ/fU97P5BW9ylwmIDB
20+
sWy0cMxg8MlvSdLytPieogaM0qMg3u5qXRGBr6Wmevkty0qgnmpGGc5zPiUbtOE8
21+
CnFFqyxBpj5IOnG0KZGVihvn+iRxrv6GO7WWO92+Dc6m94U0EEiBR7QiOwARAQAB
22+
tDRBV1MgU0FNIENMSSBQcmltYXJ5IDxhd3Mtc2FtLWNsaS1wcmltYXJ5QGFtYXpv
23+
bi5jb20+iQI/BBMBCQApBQJkbkszAhsvBQkHhM4ABwsJCAcDAgEGFQgCCQoLBBYC
24+
AwECHgECF4AACgkQQv1fenOtiFqTuhAAzi5+ju5UVOWqHKevOJSO08T4QB8HcqAE
25+
SVO3mY6/j29knkcL8ubZP/DbpV7QpHPI2PB5qSXsiDTP3IYPbeY78zHSDjljaIK3
26+
njJLMScFeGPyfPpwMsuY4nzrRIgAtXShPA8N/k4ZJcafnpNqKj7QnPxiC1KaIQWm
27+
pOtvb8msUF3/s0UTa5Ys/lNRhVC0eGg32ogXGdojZA2kHZWdm9udLo4CDrDcrQT7
28+
NtDcJASapXSQL63XfAS3snEc4e1941YxcjfYZ33rel8K9juyDZfi1slWR/L3AviI
29+
QFIaqSHzyOtP1oinUkoVwL8ThevKD3Ag9CZflZLzNCV7yqlF8RlhEZ4zcE/3s9El
30+
WzCFsozb5HfE1AZonmrDh3SyOEIBMcS6vG5dWnvJrAuSYv2rX38++K5Pr/MIAfOX
31+
DOI1rtA+XDsHNv9lSwSy0lt+iClawZANO9IXCiN1rOYcVQlwzDFwCNWDgkwdOqS0
32+
gOA2f8NF9lE5nBbeEuYquoOl1Vy8+ICbgOFs9LoWZlnVh7/RyY6ssowiU9vGUnHI
33+
L8f9jqRspIz/Fm3JD86ntZxLVGkeZUz62FqErdohYfkFIVcv7GONTEyrz5HLlnpv
34+
FJ0MR0HjrMrZrnOVZnwBKhpbLocTsH+3t5It4ReYEX0f1DIOL/KRwPvjMvBVkXY5
35+
hblRVDQoOWc=
36+
=d9oG
37+
-----END PGP PUBLIC KEY BLOCK-----"
38+
39+
SIGNER_PUBLIC_KEY="-----BEGIN PGP PUBLIC KEY BLOCK-----
40+
Version: GnuPG v2.0.22 (GNU/Linux)
41+
42+
mQINBGgrxIgBEADGCTudveeeVbWpZDGX9Ni57mBRMVSJwQJ6F/PC34jw0DozxTtd
43+
H+ZPsXLvLwerN/DVXbK8E1qNZ5RGptak8j7MPz+MC3n4txibEJpB61vpjJJM+9cC
44+
7whaMLDT/SbykHYXdrnHqa8KsUJl7rPLJcaRN722NSxvYVMIOA9ffVXV7cfEyZi5
45+
MbYF2Gc9LNbKaknImIva7EKeeh2/wI6YCqC5yytyfWU5dL6oHXsgTnFL9mhziMxv
46+
WhyzawyJG6EJZsJ3WLlbIKApN6XZSXyCxOvlBrebYZjD5v0nA+TJaQ7is8atjtOI
47+
DGe0AViw7kO8ChTpjA7YG/Uu7n/Fy7qLF/3Nz0b6cBNjemjBazQ3A3KNCpi5hqFM
48+
Uo1WpoVLr5CXQnc0B3fBUnTIoxi0Sk5MKjH9AbYxfgqEX0ZJB9hAlc6LIEy0Yru6
49+
MMBrIHE86IMl1NfE/DeLnCdPG23+1PttwyOt3+9z5QwmPe3VPpEfCySPcdxHKZSP
50+
rLile8qDznEvlPDvQ0qkBxdMtVa2yct5VJkdqy6UrN2xa0dpspHjRUjHh/EY/xMt
51+
fwMUjOKohaZ/1pjotCcksAsZWUxCNcFvLYxuxeytVk4F09Es1hj4ihhLUI+43/ic
52+
3DHSEiext7Q8/UccNArkhSCT7UOvvL7QTuP+pjYTyiC8Vx6g/Y5Ht5+qywARAQAB
53+
tDBBV1MgU0FNIENMSSBUZWFtIDxhd3Mtc2FtLWNsaS1zaWduZXJAYW1hem9uLmNv
54+
bT6JAj8EEwEJACkFAmgrxIgCGy8FCQPCZwAHCwkIBwMCAQYVCAIJCgsEFgIDAQIe
55+
AQIXgAAKCRBAlKuxvt/atJo6EAC/5C8uJs76W5f5V5XNAMzwBFiZuYpop3DRReCo
56+
P68ZZylokAC9ShRZnIOujpDJtlNS7T/G00BzmcpspkYYE531ALaXcHWmb9XV0Ajg
57+
J8iboAVBLY0C7mhL/cbJ3v9QlpXXjyTuhexkJCV8rdHVX/0H8WqTZplEaRuZ7p8q
58+
PMxddg4ClwstYuH3O/dmNdlGqfb4Fqy8MnV1yGSXRs5Jf+sDlN2UO4mbpyk/mr1c
59+
f/jFxmx86IkCWJVvdXWCVTe2AFy3NHCdLtdnEvFhokCOQd9wibUWX0j9vq4cVRZT
60+
qamnpAQaOlH3lXOwrjqo8b1AIPoRWSfMtCYvh6kA8MAJv4cAznzXILSLtOE0mzaU
61+
qp5qoy37wNIjeztX6c/q4wss05qTlJhnNu4s3nh5VHultooaYpmDxp+ala5TWeuM
62+
KZDI4KdAGF4z0Raif+N53ndOYIiXkY0goUbsPCnVrCwoK9PjjyoJncq7c14wNl5O
63+
IQUZEjyYAQDGZqs5XSfY4zW2cCXatrfozKF7R1kSU14DfJwPUyksoNAQEQezfXyq
64+
kr0gfIWK1r2nMdqS7WgSx/ypS5kdyrHuPZdaYfEVtuezpoT2lQQxOSZqqlp5hI4R
65+
nqmPte53WXJhbC0tgTIJWn+Uy/d5Q/aSIfD6o8gNLS1BDs1j1ku0XKu1sFCHUcZG
66+
aerdsIkCHAQQAQkABgUCaCvFeAAKCRBC/V96c62IWt3/D/9gOLzWtz62lqJRCsri
67+
wcA/yz88ayKb/GUv3FCT5Nd9JZt8y1tW+AE3SPTdcpfZmt5UN2sRzljO61mpKJzp
68+
eBvYQ9og/34ZrRQqeg8bz02u34LKYl1gD0xY0bWtB7TGIxIZZYqZECoPR0Dp6ZzB
69+
abzkRSsJkEk0vbZzJhfWFYs98qfp/G0suFSBE79O8Am33DB2jQ/Sollh1VmNE6Sv
70+
EOgR6+2yEkS2D0+msJMa/V82v9gBTPnxSlNV1d8Dduvt9rbM3LoxiNXUgx/s52yY
71+
U6H3bwUcQ3UY6uRe1UWo5QnMFcDwfg43+q5rmjB4xQyX/BaQyF5K0hZyG+42/pH1
72+
EMwl8qN617FTxo3hvQUi/cBahlhQ8EVYsGnHDVxLCisbq5iZvp7+XtmMy1Q417gT
73+
EQRo8feJh31elGWlccVR2pZgIm1PQ69dzzseHnnKkGhifik0bDGo5/IH2EgI1KFn
74+
SG399RMU/qRzOPLVP3i+zSJmhMqG8cnZaUwE5V4P21vQSclhhd2Hv/C4SVKNqA2i
75+
+oZbHj2vAkuzTTL075AoANebEjPGqwsKZi5mWUE5Pa931JeiXxWZlEB7rkgQ1PAB
76+
fsDBhYLt4MxCWAhifLMA6uQ4BhXu2RuXOqNfSbqa8jVF6DB6cD8eAHGpPKfJOl30
77+
LtZnq+n4SfeNbZjD2FQWZR4CrA==
78+
=lHfs
79+
-----END PGP PUBLIC KEY BLOCK-----"
80+
81+
if [ "$(id -u)" -ne 0 ]; then
82+
echo -e 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
83+
exit 1
84+
fi
85+
86+
apt_get_update()
87+
{
88+
if [ "$(find /var/lib/apt/lists/* | wc -l)" = "0" ]; then
89+
echo "Running apt-get update..."
90+
apt-get update -y
91+
fi
92+
}
93+
94+
# Checks if packages are installed and installs them if not
95+
check_packages() {
96+
if ! dpkg -s "$@" > /dev/null 2>&1; then
97+
apt_get_update
98+
apt-get -y install --no-install-recommends "$@"
99+
fi
100+
}
101+
102+
export DEBIAN_FRONTEND=noninteractive
103+
104+
check_packages curl ca-certificates gpg dirmngr unzip bash-completion less
105+
106+
verify_aws_sam_cli_gpg_signature() {
107+
local filePath=$1
108+
local sigFilePath=$2
109+
tmp_dir="$(mktemp -d)"
110+
trap 'rm -rf "${tmp_dir}"' EXIT
111+
local awsGpgKeyring="${tmp_dir}/aws-sam-cli-public-key.gpg"
112+
113+
echo "${PRIMARY_PUBLIC_KEY}" | gpg --dearmor > "${awsGpgKeyring}"
114+
echo "${SIGNER_PUBLIC_KEY}" | gpg --dearmor >> "${awsGpgKeyring}"
115+
116+
gpg --batch --quiet --no-default-keyring --keyring "${awsGpgKeyring}" --verify "${sigFilePath}" "${filePath}"
117+
local status=$?
118+
119+
return ${status}
120+
}
121+
122+
install() {
123+
tmp_dir="$(mktemp -d)"
124+
trap 'rm -rf "${tmp_dir}"' EXIT
125+
126+
local scriptZipFile="${tmp_dir}/aws-sam-cli.zip"
127+
local scriptSigFile="${tmp_dir}/aws-sam-cli.sig"
128+
129+
architecture=$(dpkg --print-architecture)
130+
case "${architecture}" in
131+
amd64) architectureStr=x86_64 ;;
132+
arm64) architectureStr=arm64 ;;
133+
*)
134+
echo "AWS SAM CLI does not support machine architecture '$architecture'. Please use an x86-64 or ARM64 machine."
135+
exit 1
136+
esac
137+
local scriptUrl=https://github.com/aws/aws-sam-cli/releases/download/${VERSION}/aws-sam-cli-linux-${architectureStr}.zip
138+
echo "Downloading AWS SAM CLI from ${scriptUrl}..."
139+
curl -fsSL "${scriptUrl}" -o "${scriptZipFile}"
140+
curl -fsSL "${scriptUrl}.sig" -o "${scriptSigFile}"
141+
142+
verify_aws_sam_cli_gpg_signature "$scriptZipFile" "$scriptSigFile"
143+
if (( $? > 0 )); then
144+
echo "Could not verify GPG signature of AWS CLI install script. Make sure you provided a valid version."
145+
exit 1
146+
fi
147+
echo "GPG signature of AWS SAM CLI install script verified successfully. Installing..."
148+
unzip -q "${scriptZipFile}" -d "${tmp_dir}/aws-sam-cli"
149+
"${tmp_dir}/aws-sam-cli/install"
150+
151+
echo "AWS SAM CLI installed successfully."
152+
}
153+
154+
echo "(*) Installing AWS SAM CLI..."
155+
156+
install
157+
158+
# Clean up
159+
rm -rf /var/lib/apt/lists/*
160+
161+
echo "Done!"

‎src/base/.devcontainer/scripts/install_github_release.sh‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
export DEBIAN_FRONTEND=noninteractive
5+
6+
DEFAULT_INSTALL_DIR="/usr/local/bin"
7+
INSTALL_DIR="${INSTALL_DIR:-$DEFAULT_INSTALL_DIR}"
8+
9+
if ! command -v curl >/dev/null 2>&1 || ! command -v unzip >/dev/null 2>&1; then
10+
apt-get update
11+
apt-get install -y --no-install-recommends curl unzip ca-certificates
12+
fi
13+
14+
if ! command -v gh >/dev/null 2>&1; then
15+
echo "GitHub CLI (gh) is required for attestation verification but was not found"
16+
exit 1
17+
fi
18+
19+
if [ "${VERIFY_BINARY_ATTESTATION}" != "true" ] && [ "${VERIFY_CHECKSUM}" != "true" ]; then
20+
echo "VERIFY_BINARY_ATTESTATION or VERIFY_CHECKSUM must be set to true"
21+
exit 1
22+
fi
23+
24+
BINARY_URL="https://github.com/${GITHUB_REPO}/releases/download/${VERSION}/${DOWNLOAD_BINARY}"
25+
BINARY_ASSET_NAME="${DOWNLOAD_BINARY}"
26+
CHECKSUMS_URL="https://github.com/${GITHUB_REPO}/releases/download/${VERSION}/checksums.txt"
27+
tmp_dir="$(mktemp -d)"
28+
trap 'rm -rf "${tmp_dir}"' EXIT
29+
30+
curl -fsSL "${BINARY_URL}" -o "${tmp_dir}/${BINARY_ASSET_NAME}"
31+
if [ "${VERIFY_BINARY_ATTESTATION}" == "true" ]; then
32+
gh attestation verify "${tmp_dir}/${BINARY_ASSET_NAME}" -R "${GITHUB_REPO}"
33+
fi
34+
35+
if [ "${VERIFY_CHECKSUM}" == "true" ]; then
36+
curl -fsSL "${CHECKSUMS_URL}" -o "${tmp_dir}/checksums.txt"
37+
gh attestation verify "${tmp_dir}/checksums.txt" -R "${GITHUB_REPO}"
38+
(
39+
cd "${tmp_dir}"
40+
sha256sum --ignore-missing -c checksums.txt
41+
)
42+
fi
43+
44+
if [ "${COMPRESSION}" == "zip" ]; then
45+
unzip -q "${tmp_dir}/${BINARY_ASSET_NAME}" -d "${tmp_dir}"
46+
elif [ "${COMPRESSION}" == "tar.gz" ]; then
47+
tar -xzf "${tmp_dir}/${BINARY_ASSET_NAME}" -C "${tmp_dir}"
48+
else
49+
echo "Unsupported compression format: ${COMPRESSION}"
50+
exit 1
51+
fi
52+
53+
mkdir -p "$INSTALL_DIR"
54+
install -m 0755 "$tmp_dir/$TOOL" "${INSTALL_DIR}/${TOOL}"

0 commit comments

Comments
 (0)