ci(security): pin and verify the Trivy installer - #996
Merged
Merged
Conversation
The Trivy install step piped a script fetched from a tag straight into a shell. A tag can be moved to other content, so the job ran whatever the ref pointed at, with the runner's privileges, and the Scorecard check flagged it as an unpinned download-then-run. The script now comes from the commit the tag points at, is checked against its SHA-256 before it runs, and the binary version stays what it was.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Trivy install step fetched
contrib/install.shfrom a tag and piped it into a shell. A tag can be moved to other content, so the job ran whatever that ref pointed at with the runner's privileges. Code scanning flagged it: ScorecardPinned-Dependencies, "downloadThenRun not pinned by hash" (alert 88).The script now comes from the commit
v0.74.0points at, is verified against its SHA-256 before it runs, and the installed binary version is unchanged. Both values are in the step's env and get bumped together.