Skip to content

Commit 2e8b059

Browse files
LucaCappelletti94LucaCappelletti94
authored
Verify the upstream signature on every run and add zizmor and cargo-deny (#9)
1 parent 131f683 commit 2e8b059

11 files changed

Lines changed: 103 additions & 23 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,17 @@ updates:
55
directory: /
66
schedule:
77
interval: weekly
8+
cooldown:
9+
default-days: 7
810
- package-ecosystem: cargo
911
directory: /smoke
1012
schedule:
1113
interval: weekly
14+
cooldown:
15+
default-days: 7
1216
- package-ecosystem: cargo
1317
directory: /wasm
1418
schedule:
1519
interval: weekly
20+
cooldown:
21+
default-days: 7

‎.github/workflows/ci.yml‎

Lines changed: 37 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ jobs:
3131
toolchain: [stable, "1.81"]
3232
steps:
3333
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34+
with:
35+
persist-credentials: false
3436
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
3537
with:
3638
toolchain: ${{ matrix.toolchain }}
@@ -41,6 +43,8 @@ jobs:
4143
runs-on: ubuntu-latest
4244
steps:
4345
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
46+
with:
47+
persist-credentials: false
4448
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
4549
with:
4650
toolchain: stable
@@ -59,11 +63,36 @@ jobs:
5963
runs-on: ubuntu-latest
6064
steps:
6165
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
62-
- run: shellcheck upgrade.sh bump.sh
66+
with:
67+
persist-credentials: false
68+
- run: shellcheck -x upgrade.sh bump.sh sigstore.sh
6369
- name: actionlint
6470
run: |
6571
bash <(curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/914e7df21a07ef503a81201c76d2b11c789d3fca/scripts/download-actionlint.bash) 1.7.12
6672
./actionlint -color
73+
- uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2.87.19
74+
with:
75+
tool: zizmor@1.30.1
76+
# The token enables the online audits, which catch impostor commits and known-vulnerable actions.
77+
- run: zizmor .
78+
env:
79+
GH_TOKEN: ${{ github.token }}
80+
81+
deny:
82+
name: Dependencies of the test crates pass cargo-deny
83+
runs-on: ubuntu-latest
84+
steps:
85+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
86+
with:
87+
persist-credentials: false
88+
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
89+
with:
90+
toolchain: stable
91+
- uses: taiki-e/install-action@7623a79cdfecb99d681017af368ca353d9f49bb5 # v2.87.19
92+
with:
93+
tool: cargo-deny@0.20.2
94+
- run: cargo deny --manifest-path smoke/Cargo.toml check
95+
- run: cargo deny --manifest-path wasm/Cargo.toml check
6796

6897
compile:
6998
name: Compile the packaged amalgamation on ${{ matrix.os }}
@@ -74,6 +103,8 @@ jobs:
74103
os: [ubuntu-latest, macos-latest, windows-latest]
75104
steps:
76105
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
106+
with:
107+
persist-credentials: false
77108
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
78109
with:
79110
toolchain: stable
@@ -95,6 +126,8 @@ jobs:
95126
runs-on: ubuntu-latest
96127
steps:
97128
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
129+
with:
130+
persist-credentials: false
98131
- uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
99132
with:
100133
toolchain: stable
@@ -122,5 +155,8 @@ jobs:
122155
runs-on: ubuntu-latest
123156
steps:
124157
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
158+
with:
159+
persist-credentials: false
160+
- uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
125161
- run: ./upgrade.sh
126162
- run: git diff --exit-code

‎.github/workflows/codeql.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ jobs:
3333
build-mode: none
3434
steps:
3535
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
36+
with:
37+
persist-credentials: false
3638

3739
- name: Initialize CodeQL
3840
uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1

‎.github/workflows/coverage.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ jobs:
2929
github.event.pull_request.user.login != 'dependabot[bot]')
3030
steps:
3131
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
32+
with:
33+
persist-credentials: false
3234

3335
- name: Install stable toolchain with llvm-tools
3436
run: |

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,8 @@ jobs:
5252
ci:
5353
name: CI
5454
needs: verify
55-
uses: ./.github/workflows/ci.yml
55+
# actionlint 1.7.12 rejects $/ (rhysd/actionlint#711), and a local reusable workflow already loads from this commit.
56+
uses: ./.github/workflows/ci.yml # zizmor: ignore[self-repository]
5657

5758
publish:
5859
name: Publish ${{ github.ref_name }}

‎.github/workflows/sonar.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ jobs:
3232
with:
3333
# Full history improves blame-based new-code attribution.
3434
fetch-depth: 0
35+
persist-credentials: false
3536

3637
- name: Install stable toolchain with clippy and llvm-tools
3738
run: |

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ The version encodes the release, so `205.1.x` is SQLite3MC 2.5.1. A `205.1` requ
1919

2020
SQLite3MC is MIT licensed. The amalgamation also carries public-domain code (SQLite among it), a password-hashing file under CC0-1.0, a block under the Unlicense, and Argon2 under CC0-1.0 or Apache-2.0.
2121

22-
A daily workflow in the [repository](https://github.com/LucaCappelletti94/sqlite3mc-src) opens a pull request for each new SQLite3MC release, taking the archive's checksum only from the release's Sigstore-signed `SHA256SUMS`. CI re-runs `upgrade.sh` to prove the vendored bytes match the pinned release.
22+
A daily workflow in the [repository](https://github.com/LucaCappelletti94/sqlite3mc-src) opens a pull request for each new SQLite3MC release, taking the archive's checksum only from the release's Sigstore-signed `SHA256SUMS`. CI re-runs `upgrade.sh`, which checks that signature again before trusting the pinned checksum, to prove the vendored bytes match the pinned release.

‎bump.sh‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,14 @@
11
#!/bin/sh -e
22

3-
# Moves the vendored SQLite3MC to release VERSION. The archive checksum and the SQLite version
4-
# come from the release's SHA256SUMS, accepted only with a valid Sigstore signature from
5-
# SQLite3MC's own release workflow.
3+
# Moves the vendored SQLite3MC to release VERSION, taking the archive checksum and SQLite version from its signed SHA256SUMS.
64
VERSION=${1:?usage: bump.sh VERSION}
75
echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$' || { echo "not a release version: $VERSION" >&2; exit 1; }
86

97
cd "$(dirname "$0")"
10-
RELEASE="https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v${VERSION}"
8+
. ./sigstore.sh
119
WORK=$(mktemp -d)
1210
trap 'rm -rf "$WORK"' EXIT
13-
14-
for file in SHA256SUMS SHA256SUMS.pem SHA256SUMS.sig; do
15-
curl -sfL -o "$WORK/$file" "$RELEASE/sqlite3mc-${VERSION}-$file"
16-
done
17-
cosign verify-blob \
18-
--certificate "$WORK/SHA256SUMS.pem" \
19-
--signature "$WORK/SHA256SUMS.sig" \
20-
--certificate-identity-regexp '^https://github\.com/utelle/SQLite3MultipleCiphers/\.github/workflows/[^@]+@refs/heads/main$' \
21-
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
22-
"$WORK/SHA256SUMS"
11+
fetch_signed_sums "$VERSION" "$WORK"
2312

2413
ESCAPED=$(echo "$VERSION" | sed 's/\./\\./g')
2514
LINE=$(grep -E "^[0-9a-f]{64} sqlite3mc-${ESCAPED}-sqlite-[0-9]+\.[0-9]+\.[0-9]+-amalgamation\.zip$" "$WORK/SHA256SUMS")

‎deny.toml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Dependency policy for the unpublished test crates in smoke/ and wasm/, whose dependencies are mostly dev-dependencies.
2+
3+
[advisories]
4+
yanked = "deny"
5+
6+
[licenses]
7+
# sqlite3mc-src's own expression needs MIT, CC0-1.0 and the Unlicense, and unicode-ident needs Unicode-3.0.
8+
allow = ["Apache-2.0", "CC0-1.0", "MIT", "Unicode-3.0", "Unlicense"]
9+
include-dev = true
10+
private = { ignore = true }
11+
# One policy serves both graphs, and smoke/ alone never meets every licence.
12+
unused-allowed-license = "allow"
13+
14+
[bans]
15+
multiple-versions = "deny"
16+
multiple-versions-include-dev = true
17+
wildcards = "deny"
18+
allow-wildcard-paths = true
19+
20+
[sources]
21+
unknown-registry = "deny"
22+
unknown-git = "deny"

‎sigstore.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# shellcheck shell=sh
2+
# SQLite3MC's release signing identity, sourced by bump.sh and upgrade.sh.
3+
4+
# Writes release $1's SHA256SUMS to $2/SHA256SUMS once it verifies as signed by SQLite3MC's own release workflow.
5+
fetch_signed_sums() {
6+
release="https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v$1"
7+
for file in SHA256SUMS SHA256SUMS.pem SHA256SUMS.sig; do
8+
curl -sfL -o "$2/$file" "$release/sqlite3mc-$1-$file"
9+
done
10+
cosign verify-blob \
11+
--certificate "$2/SHA256SUMS.pem" \
12+
--signature "$2/SHA256SUMS.sig" \
13+
--certificate-identity-regexp '^https://github\.com/utelle/SQLite3MultipleCiphers/\.github/workflows/[^@]+@refs/heads/main$' \
14+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
15+
"$2/SHA256SUMS"
16+
}

0 commit comments

Comments
 (0)