actions/setup-php
1
0
Fork 0
mirror of https://github.com/shivammathur/setup-php.git synced 2026-08-30 02:33:46 +07:00
Code Issues Packages Projects Releases Wiki Activity

Harden tool checksum verification (#1099)

Browse Source
This commit is contained in:
Shivam Mathur
2026-07-23 19:24:32 +05:30
committed by GitHub
parent 8ca9579834
commit 8e6e5267e7
6 changed files with 90 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/scripts/tools/add_tools.ps1
+34 -14
View File
@@ -144,6 +144,21 @@ Function Test-MutableToolUrl() {
return ($Url -match $mutableUrlRegex) -or (($Url -match '\.phar([?#].*)?$') -and -not ($Url -match $versionLikeRegex))
}
# Function to verify the checksum of a file.
Function Test-ToolChecksum() {
Param(
[Parameter(Position = 0, Mandatory = $true)]
[string]
$Path,
[Parameter(Position = 1, Mandatory = $true)]
[string]
$Checksum
)
$checksum_parts = $Checksum -split ':'
$actual_checksum = (Get-FileHash -Path $Path -Algorithm $checksum_parts[0]).Hash
return $actual_checksum -eq $checksum_parts[1]
}
# Function to extract tool version.
Function Get-ToolVersion() {
Param (
@@ -255,7 +270,12 @@ Function Add-Tool() {
$use_cache = -not (Test-MutableToolUrl $urls[0])
$status_code = 200
if ($use_cache -and (Test-Path $cache_path -PathType Leaf)) {
Copy-Item $cache_path -Destination $tool_path -Force
if($checksum -and -not(Test-ToolChecksum $cache_path $checksum)) {
Remove-Item $cache_path -Force -ErrorAction SilentlyContinue
$status_code = 'checksum_mismatch'
} else {
Copy-Item $cache_path -Destination $tool_path -Force
}
} else {
$backup_path = "$tool_path.bak"
if (Test-Path $tool_path) { Copy-Item $tool_path -Destination $backup_path -Force }
@@ -275,29 +295,29 @@ Function Add-Tool() {
}
}
if($status_code -eq 200 -and (Test-Path $tool_path)) {
if ($use_cache) {
Copy-Item $tool_path -Destination $cache_path -Force
}
break
}
}
if($status_code -eq 200 -and (Test-Path $tool_path)) {
if($checksum -and -not(Test-ToolChecksum $tool_path $checksum)) {
Remove-Item @($tool_path, $cache_path) -Force -ErrorAction SilentlyContinue
$status_code = 'checksum_mismatch'
} elseif($use_cache) {
Copy-Item $tool_path -Destination $cache_path -Force
}
}
if ($status_code -ne 200 -and (Test-Path $backup_path)) {
Copy-Item $backup_path -Destination $tool_path -Force
}
Remove-Item $backup_path -Force -ErrorAction SilentlyContinue
}
if($checksum -and ($status_code -eq 200) -and (Test-Path $tool_path)) {
$checksum_parts = $checksum -split ':'
$actual_checksum = (Get-FileHash -Path $tool_path -Algorithm $checksum_parts[0]).Hash
if($actual_checksum -ne $checksum_parts[1]) {
Remove-Item @($tool_path, $cache_path) -Force -ErrorAction SilentlyContinue
if($tool -eq "composer") {
$env:fail_fast = 'true'
}
Add-Log $cross $tool "Checksum verification failed for $tool"
return
if($status_code -eq 'checksum_mismatch') {
if($tool -eq "composer") {
$env:fail_fast = 'true'
}
Add-Log $cross $tool "Checksum verification failed for $tool"
return
}
$escaped_tool = [regex]::Escape($tool)
src/scripts/tools/add_tools.sh
+14 -7
View File
@@ -227,7 +227,12 @@ add_tool() {
is_mutable_tool_url "${url[0]}" && use_cache=false
status_code="200"
if [ "$use_cache" = "true" ] && [ -f "$cache_path" ]; then
sudo cp -a "$cache_path" "$tool_path"
if [ -n "$checksum" ] && ! verify_checksum "$cache_path" "$checksum"; then
sudo rm -f "$cache_path"
status_code="checksum_mismatch"
else
sudo cp -a "$cache_path" "$tool_path"
fi
else
[ -f "$tool_path" ] && sudo cp -a "$tool_path" "$tool_path.bak"
status_code=$(get -v -e "$tool_path" "${url[@]}")
@@ -236,16 +241,18 @@ add_tool() {
status_code=$(get -v -e "$tool_path" "${url[0]}")
fi
if [ "$status_code" = "200" ]; then
[ "$use_cache" = "true" ] && sudo cp -a "$tool_path" "$cache_path"
elif [ -f "$tool_path.bak" ]; then
if [ -n "$checksum" ] && ! verify_checksum "$tool_path" "$checksum"; then
sudo rm -f "$tool_path" "$cache_path"
status_code="checksum_mismatch"
elif [ "$use_cache" = "true" ]; then
sudo cp -a "$tool_path" "$cache_path"
fi
fi
if [ "$status_code" != "200" ] && [ -f "$tool_path.bak" ]; then
sudo mv "$tool_path.bak" "$tool_path"
fi
sudo rm -f "$tool_path.bak"
fi
if [ "$status_code" = "200" ] && [ -n "$checksum" ] && ! verify_checksum "$tool_path" "$checksum"; then
sudo rm -f "$tool_path" "$cache_path"
status_code="checksum_mismatch"
fi
if [ "$status_code" = "200" ]; then
add_tools_helper "$tool"
tool_version=$(get_tool_version "$tool" "$ver_param")