Skip to content

Commit bb4e5eb

Browse files
maniSbindraCopilot
maniSbindra
and
Copilot
authored
fix: pin install script URLs to commit SHAs and eliminate pipe-to-shell (#246)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 22a32db commit bb4e5eb

11 files changed

Lines changed: 250 additions & 72 deletions

‎.taskfiles/azure.Taskfile.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ vars:
99
az: latest
1010
azd: latest
1111
bicep: latest
12+
AZURE_INSTALLER_SHA:
13+
map:
14+
azd: 0340065907dee7ca71cd68ed132033cabb38cbce # 2025-03-27 Azure/azure-dev cli/installer/install-azd.sh
1215

1316
tasks:
1417
# * Install Azure CLI
@@ -43,7 +46,7 @@ tasks:
4346
vars:
4447
APP: azd@{{.AZURE_VERSION.azd}}
4548
- cmd: |
46-
./scripts/install_azd.sh "{{.AZURE_VERSION.azd}}"
49+
INSTALLER_SHA="{{.AZURE_INSTALLER_SHA.azd}}" ./scripts/install_azd.sh "{{.AZURE_VERSION.azd}}"
4750
platforms: [linux]
4851
dir: "{{.TASKFILE_DIR}}"
4952

‎.taskfiles/github.Taskfile.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ vars:
1111
pinact: latest
1212
ghalint: latest
1313
gh: latest
14+
GITHUB_INSTALLER_SHA:
15+
map:
16+
actionlint: 62c50a97a146fe36a8951a2a365158c4a4795ba8 # v1.7.11 rhysd/actionlint scripts/download-actionlint.bash
17+
act: fe017a109f2b78fa5d8cdd3ad2c5691443665c89 # 2024-12-25 nektos/act install.sh
1418

1519
tasks:
1620
# * Install Actionlint
@@ -25,7 +29,7 @@ tasks:
2529
vars:
2630
APP: actionlint@{{.GITHUB_VERSION.actionlint}}
2731
- cmd: |
28-
./scripts/install_actionlint.sh "{{.GITHUB_VERSION.actionlint}}"
32+
INSTALLER_SHA="{{.GITHUB_INSTALLER_SHA.actionlint}}" ./scripts/install_actionlint.sh "{{.GITHUB_VERSION.actionlint}}"
2933
platforms: [linux]
3034
dir: "{{.TASKFILE_DIR}}"
3135

@@ -41,7 +45,7 @@ tasks:
4145
vars:
4246
APP: act@{{.GITHUB_VERSION.act}}
4347
- cmd: |
44-
./scripts/install_act.sh "{{.GITHUB_VERSION.act}}"
48+
INSTALLER_SHA="{{.GITHUB_INSTALLER_SHA.act}}" ./scripts/install_act.sh "{{.GITHUB_VERSION.act}}"
4549
platforms: [linux]
4650
dir: "{{.TASKFILE_DIR}}"
4751

‎.taskfiles/golang.Taskfile.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ vars:
1717
goTestCoverage: latest
1818
gocoverCobertura: latest
1919
goreleaser: latest
20+
GO_INSTALLER_SHA:
21+
map:
22+
golangciLint: 870ddc133592c3609f26af3b6f05ce2dd4a7afda # 2025-10-13 golangci/golangci-lint install.sh
2023

2124
tasks:
2225
# * Install GoReleaser
@@ -71,7 +74,7 @@ tasks:
7174
vars:
7275
APP: golangci-lint@{{.GO_VERSION.golangciLint}}
7376
- cmd: |
74-
./scripts/install_golangci-lint.sh "{{.GO_VERSION.golangciLint}}"
77+
INSTALLER_SHA="{{.GO_INSTALLER_SHA.golangciLint}}" ./scripts/install_golangci-lint.sh "{{.GO_VERSION.golangciLint}}"
7578
platforms: [linux]
7679
dir: "{{.TASKFILE_DIR}}"
7780

‎.taskfiles/runtime.Taskfile.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@ vars:
1010
fnm: latest
1111
pwsh: latest
1212
golang: latest
13+
RUNTIME_INSTALLER_SHA:
14+
map:
15+
fnm: bfb186034978b1ddaf87501eb1633bdc42a5c0a6 # 2026-03-09 Schniz/fnm .ci/install.sh
1316
PYTHON_VERSION:
1417
sh: |
1518
[ -f .python-version ] && cat .python-version || echo "3.14"
@@ -67,7 +70,7 @@ tasks:
6770
desc: fnm setup
6871
cmds:
6972
- cmd: |
70-
./scripts/setup_fnm.sh "{{.RUNTIME_VERSION.fnm}}"
73+
INSTALLER_SHA="{{.RUNTIME_INSTALLER_SHA.fnm}}" ./scripts/setup_fnm.sh "{{.RUNTIME_VERSION.fnm}}"
7174
platforms: [linux]
7275
- task: :internal:_install:brew
7376
vars:

‎.taskfiles/scripts/install_act.sh‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,19 @@ set -euo pipefail
66
readonly GITHUB_OWNER="nektos"
77
readonly GITHUB_REPO="act"
88
readonly TOOL_NAME="act"
9-
readonly INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${GITHUB_OWNER}/${GITHUB_REPO}/master/install.sh"
10-
11-
# Configuration (can be overridden by env)
9+
# Installer script SHA provided via INSTALLER_SHA env var from Taskfile
10+
# To update: change the SHA in github.Taskfile.yml GITHUB_INSTALLER_SHA.act
11+
readonly INSTALL_SCRIPT_SHA="${INSTALLER_SHA:?INSTALLER_SHA env var is required — set in Taskfile}"
12+
[[ "${INSTALL_SCRIPT_SHA}" =~ ^[0-9a-fA-F]{40}$ ]] || {
13+
echo "X Error: INSTALLER_SHA must be a full 40-character hexadecimal commit SHA" >&2
14+
exit 1
15+
}
16+
readonly INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${GITHUB_OWNER}/${GITHUB_REPO}/${INSTALL_SCRIPT_SHA}/install.sh"
1217
VERSION="${1:-${VERSION:-latest}}"
1318
INSTALL_DIR="${2:-${INSTALL_DIR:-}}"
1419

20+
tempDir=""
21+
1522
# Logging helper
1623
log() {
1724
echo "-> $*" >&2
@@ -23,6 +30,13 @@ die() {
2330
exit "${2:-1}"
2431
}
2532

33+
cleanup() {
34+
if [[ -n "${tempDir}" && -d "${tempDir}" ]]; then
35+
rm -rf "${tempDir}"
36+
fi
37+
}
38+
trap cleanup EXIT INT TERM
39+
2640
# Help message
2741
usage() {
2842
cat <<EOF
@@ -32,16 +46,20 @@ Positional arguments:
3246
VERSION Version to install (default: latest)
3347
INSTALL_DIR Custom install directory
3448
35-
Environment variables:
49+
Environment variables (required):
50+
INSTALLER_SHA Full 40-char hex commit SHA for the installer script (set by Taskfile)
51+
52+
Environment variables (optional):
3653
VERSION Desired version (default: latest)
3754
INSTALL_DIR Install directory override
3855
GITHUB_TOKEN GitHub token for API authentication
3956
4057
Examples:
41-
$0 # Install latest
42-
$0 1.2.3 # Install 1.2.3
43-
$0 1.2.3 ~/.local/bin # Install 1.2.3 to ~/.local/bin
44-
VERSION=v1.2.3 $0 # Install 1.2.3 via env
58+
INSTALLER_SHA=<sha> $0 # Install latest
59+
INSTALLER_SHA=<sha> $0 1.2.3 # Install 1.2.3
60+
INSTALLER_SHA=<sha> $0 1.2.3 ~/.local/bin # Install 1.2.3 to ~/.local/bin
61+
62+
Note: Normally invoked via Taskfile (e.g., task install:act), which sets INSTALLER_SHA automatically.
4563
EOF
4664
}
4765

@@ -84,9 +102,18 @@ else
84102
ghAuthHeader=()
85103
fi
86104

87-
# Execute remote installation script
88-
log "Fetching and executing official installation script"
89-
if ! curl "${ghAuthHeader[@]}" -fsSL "${INSTALL_SCRIPT_URL}" | /bin/bash -s -- -b "${INSTALL_DIR}" "${VERSION}"; then
105+
# Download installation script to temp file (avoid piping curl to shell)
106+
tempDir="$(mktemp -d)" || die "Failed to create temp directory"
107+
INSTALL_SCRIPT="${tempDir}/install.sh"
108+
log "Downloading official installation script (pinned to ${INSTALL_SCRIPT_SHA})"
109+
if ! curl "${ghAuthHeader[@]}" -fsSL "${INSTALL_SCRIPT_URL}" -o "${INSTALL_SCRIPT}"; then
110+
die "Failed to download installation script. Check network connection."
111+
fi
112+
chmod +x "${INSTALL_SCRIPT}"
113+
114+
# Execute downloaded script
115+
log "Executing installation script"
116+
if ! /bin/bash "${INSTALL_SCRIPT}" -b "${INSTALL_DIR}" "${VERSION}"; then
90117
die "Installation failed. Check version or network connection."
91118
fi
92119

‎.taskfiles/scripts/install_actionlint.sh‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,19 @@ set -euo pipefail
66
readonly GITHUB_OWNER="rhysd"
77
readonly GITHUB_REPO="actionlint"
88
readonly TOOL_NAME="actionlint"
9-
readonly INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${GITHUB_OWNER}/${GITHUB_REPO}/main/scripts/download-actionlint.bash"
10-
11-
# Configuration (can be overridden by env)
9+
# Installer script SHA provided via INSTALLER_SHA env var from Taskfile
10+
# To update: change the SHA in github.Taskfile.yml GITHUB_INSTALLER_SHA.actionlint
11+
readonly INSTALL_SCRIPT_SHA="${INSTALLER_SHA:?INSTALLER_SHA env var is required — set in Taskfile}"
12+
[[ "${INSTALL_SCRIPT_SHA}" =~ ^[0-9a-fA-F]{40}$ ]] || {
13+
echo "X Error: INSTALLER_SHA must be a full 40-character hexadecimal commit SHA" >&2
14+
exit 1
15+
}
16+
readonly INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/${GITHUB_OWNER}/${GITHUB_REPO}/${INSTALL_SCRIPT_SHA}/scripts/download-actionlint.bash"
1217
VERSION="${1:-${VERSION:-latest}}"
1318
INSTALL_DIR="${2:-${INSTALL_DIR:-}}"
1419

20+
tempDir=""
21+
1522
# Logging helper
1623
log() {
1724
echo "-> $*" >&2
@@ -23,6 +30,13 @@ die() {
2330
exit "${2:-1}"
2431
}
2532

33+
cleanup() {
34+
if [[ -n "${tempDir}" && -d "${tempDir}" ]]; then
35+
rm -rf "${tempDir}"
36+
fi
37+
}
38+
trap cleanup EXIT INT TERM
39+
2640
# Help message
2741
usage() {
2842
cat <<EOF
@@ -32,16 +46,20 @@ Positional arguments:
3246
VERSION Version to install (default: latest)
3347
INSTALL_DIR Custom install directory
3448
35-
Environment variables:
49+
Environment variables (required):
50+
INSTALLER_SHA Full 40-char hex commit SHA for the installer script (set by Taskfile)
51+
52+
Environment variables (optional):
3653
VERSION Desired version (default: latest)
3754
INSTALL_DIR Install directory override
3855
GITHUB_TOKEN GitHub token for API authentication
3956
4057
Examples:
41-
$0 # Install latest
42-
$0 1.2.3 # Install 1.2.3
43-
$0 1.2.3 ~/.local/bin # Install 1.2.3 to ~/.local/bin
44-
VERSION=v1.2.3 $0 # Install 1.2.3 via env
58+
INSTALLER_SHA=<sha> $0 # Install latest
59+
INSTALLER_SHA=<sha> $0 1.2.3 # Install 1.2.3
60+
INSTALLER_SHA=<sha> $0 1.2.3 ~/.local/bin # Install 1.2.3 to ~/.local/bin
61+
62+
Note: Normally invoked via Taskfile (e.g., task install:actionlint), which sets INSTALLER_SHA automatically.
4563
EOF
4664
}
4765

@@ -84,9 +102,18 @@ else
84102
ghAuthHeader=()
85103
fi
86104

87-
# Execute remote installation script
88-
log "Fetching and executing official installation script"
89-
if ! curl "${ghAuthHeader[@]}" -fsSL "${INSTALL_SCRIPT_URL}" | /bin/bash -s -- "${VERSION}" "${INSTALL_DIR}"; then
105+
# Download installation script to temp file (avoid piping curl to shell)
106+
tempDir="$(mktemp -d)" || die "Failed to create temp directory"
107+
INSTALL_SCRIPT="${tempDir}/download-actionlint.bash"
108+
log "Downloading official installation script (pinned to ${INSTALL_SCRIPT_SHA})"
109+
if ! curl "${ghAuthHeader[@]}" -fsSL "${INSTALL_SCRIPT_URL}" -o "${INSTALL_SCRIPT}"; then
110+
die "Failed to download installation script. Check network connection."
111+
fi
112+
chmod +x "${INSTALL_SCRIPT}"
113+
114+
# Execute downloaded script
115+
log "Executing installation script"
116+
if ! /bin/bash "${INSTALL_SCRIPT}" "${VERSION}" "${INSTALL_DIR}"; then
90117
die "Installation failed. Check version or network connection."
91118
fi
92119

‎.taskfiles/scripts/install_azd.sh‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,19 @@ set -euo pipefail
44

55
# Constants
66
readonly TOOL_NAME="azd"
7-
readonly INSTALL_SCRIPT_URL="https://aka.ms/install-azd.sh"
8-
9-
# Configuration (can be overridden by env)
7+
# Installer script SHA provided via INSTALLER_SHA env var from Taskfile
8+
# To update: change the SHA in azure.Taskfile.yml AZURE_INSTALLER_SHA.azd
9+
readonly INSTALL_SCRIPT_SHA="${INSTALLER_SHA:?INSTALLER_SHA env var is required — set in Taskfile}"
10+
[[ "${INSTALL_SCRIPT_SHA}" =~ ^[0-9a-fA-F]{40}$ ]] || {
11+
echo "X Error: INSTALLER_SHA must be a full 40-character hexadecimal commit SHA" >&2
12+
exit 1
13+
}
14+
readonly INSTALL_SCRIPT_URL="https://raw.githubusercontent.com/Azure/azure-dev/${INSTALL_SCRIPT_SHA}/cli/installer/install-azd.sh"
1015
VERSION="${1:-${VERSION:-latest}}"
1116
INSTALL_DIR="${2:-${INSTALL_DIR:-}}"
1217

18+
tempDir=""
19+
1320
# Logging helper
1421
log() {
1522
echo "-> $*" >&2
@@ -21,6 +28,13 @@ die() {
2128
exit "${2:-1}"
2229
}
2330

31+
cleanup() {
32+
if [[ -n "${tempDir}" && -d "${tempDir}" ]]; then
33+
rm -rf "${tempDir}"
34+
fi
35+
}
36+
trap cleanup EXIT INT TERM
37+
2438
# Help message
2539
usage() {
2640
cat <<EOF
@@ -30,16 +44,20 @@ Positional arguments:
3044
VERSION Version to install (default: latest)
3145
INSTALL_DIR Custom install directory
3246
33-
Environment variables:
47+
Environment variables (required):
48+
INSTALLER_SHA Full 40-char hex commit SHA for the installer script (set by Taskfile)
49+
50+
Environment variables (optional):
3451
VERSION Desired version (default: latest)
3552
INSTALL_DIR Install directory override
3653
GITHUB_TOKEN GitHub token for API authentication
3754
3855
Examples:
39-
$0 # Install latest
40-
$0 1.2.3 # Install 1.2.3
41-
$0 1.2.3 ~/.local/bin # Install 1.2.3 to ~/.local/bin
42-
VERSION=v1.2.3 $0 # Install 1.2.3 via env
56+
INSTALLER_SHA=<sha> $0 # Install latest
57+
INSTALLER_SHA=<sha> $0 1.2.3 # Install 1.2.3
58+
INSTALLER_SHA=<sha> $0 1.2.3 ~/.local/bin # Install 1.2.3 to ~/.local/bin
59+
60+
Note: Normally invoked via Taskfile (e.g., task install:azd), which sets INSTALLER_SHA automatically.
4361
EOF
4462
}
4563

@@ -75,9 +93,18 @@ fi
7593

7694
log "Installing ${TOOL_NAME} (${VERSION}) to ${INSTALL_DIR}"
7795

78-
# Execute remote installation script
79-
log "Fetching and executing official installation script"
80-
if ! curl -fsSL "${INSTALL_SCRIPT_URL}" | /bin/bash -s -- --version "${VERSION}" --install-folder "${INSTALL_DIR}" --symlink-folder "${INSTALL_DIR}"; then
96+
# Download installation script to temp file (avoid piping curl to shell)
97+
tempDir="$(mktemp -d)" || die "Failed to create temp directory"
98+
INSTALL_SCRIPT="${tempDir}/install-azd.sh"
99+
log "Downloading official installation script (pinned to ${INSTALL_SCRIPT_SHA})"
100+
if ! curl -fsSL "${INSTALL_SCRIPT_URL}" -o "${INSTALL_SCRIPT}"; then
101+
die "Failed to download installation script. Check network connection."
102+
fi
103+
chmod +x "${INSTALL_SCRIPT}"
104+
105+
# Execute downloaded script
106+
log "Executing installation script"
107+
if ! /bin/bash "${INSTALL_SCRIPT}" --version "${VERSION}" --install-folder "${INSTALL_DIR}" --symlink-folder "${INSTALL_DIR}"; then
81108
die "Installation failed. Check version or network connection."
82109
fi
83110

0 commit comments

Comments
 (0)