From d7cb41e37c4fa7cda9f0e9a50c58288890f4cc21 Mon Sep 17 00:00:00 2001 From: Kunal Mehta Date: Wed, 24 Apr 2024 11:10:35 -0400 Subject: [PATCH] Verify sha256sums.txt and signatures in CI Avoids a situation like , where wheels are updated, but the sha256sums and associated signatures are not. --- .github/workflows/ci.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ff027e..b18d3e7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,3 +27,20 @@ jobs: run: | . ./.venv/bin/activate make test + + checksums: + runs-on: ubuntu-latest + container: debian:bookworm + steps: + - name: Bootstrap Debian system package dependencies + run: | + apt-get update && apt-get install --yes --no-install-recommends make git git-lfs ca-certificates + - uses: actions/checkout@v4 + with: + lfs: true + - name: Verify checksums and signatures + run: | + ./scripts/verify-sha256sum-signature securedrop-client + ./scripts/verify-sha256sum-signature securedrop-export + ./scripts/verify-sha256sum-signature securedrop-log + ./scripts/verify-sha256sum-signature securedrop-proxy