Andrea Lorenzetti ca58dd0ce3 feat(security): verify drone-ssh binary checksum after download (#410) ...

* Verify drone-ssh binary checksum after download

Download checksums.txt from the drone-ssh release alongside the binary and verify it. Protects against tampered or corrupted release artifacts.

* refactor: make checksum verification portable across minimal containers

- Detect shasum (Perl) or sha256sum (coreutils/busybox) and fall back
  gracefully; warn and skip verification only when neither tool exists,
  so container jobs without perl are not broken
- Look up the exact checksums.txt entry for the target binary and
  compare hashes directly, avoiding the --ignore-missing flag that
  busybox sha256sum does not support
- Fail closed when checksums.txt has no entry for the binary
- Remove checksums.txt after successful verification

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-15 11:21:31 +08:00

4.1 KiB

Executable File

Raw Blame History

View Raw