Conversation
|
Light ping 🙂 — this has been green and awaiting review for about 4 weeks now. Happy to rebase or address any feedback whenever a maintainer has a chance to take a look. Thanks for maintaining this project! |
|
@rainkwan @ansgarm — following up on my 8 Jul note, and correcting it: I said this had been green for about four weeks, which wasn't right. There are no workflow runs at all on this PR — zero runs and zero check suites — with It looks like this one predates the current fork-PR approval gate: newer fork PRs (#570, #571) at least register runs sitting at Happy to push a rebase if that's the easier path — or approve/dispatch it as-is if that's simpler. The change verifies the downloaded Terraform archive against the published |
|
Checking in on this one. It verifies the downloaded archive against the published SHA256SUMS before extracting, and it is green. If there is anything you would like changed in the approach, I am glad to rework it. |
Related Issue
Fixes #556
Description
setup-terraformdownloaded the Terraform release zip and extracted it without verifying its integrity — TLS protected the bytes in transit, but the action took no defense-in-depth step beyond that, so a compromised mirror, CDN incident, or any future change to the resolved URL could land an arbitrary binary on every runner.This adds a single verification step in
downloadCLI, right after the download and before extraction:@hashicorp/js-releases(already a dependency) exposesRelease.verify(pkg, buildName), which fetches the release'sterraform_<v>_SHA256SUMS, verifies its detached PGP signature against the embedded HashiCorp release key, then compares the SHA-256 of the downloaded archive against the signed checksum — failing the install loudly on any mismatch. Reusing this existing, already-vendored method keeps the change minimal and covers both the SHA-256 check and the stronger signature-verification path described in the issue, with no new input or behavior toggle.The Apache Software Foundation flags every release of this action in its approved-actions allowlist because of this missing check (see #556); this closes that gap so future version bumps no longer require a manual security re-review.
Validation
npm test— semistandard clean, 19/19 jest pass (added 2 tests: verification is invoked with the platform build name; a checksum mismatch aborts before extraction).npm run build—dist/rebuilt; diff is limited to the logical change.ENHANCEMENTSfragment for Verify downloaded Terraform zip against published SHA256SUMS / SHA256SUMS.sig #556.Rollback Plan
Changes to Security Controls
Yes. This adds an integrity control to the install path: the downloaded Terraform archive is now verified against HashiCorp's PGP-signed
SHA256SUMSbefore it is extracted or placed on thePATH. A failed or missing verification aborts the install. No logging, access-control, or credential-handling behavior changes.