From a6b150c36e5077ad3f75585a877798174aaabd74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Wed, 16 Sep 2026 13:05:21 +0200 Subject: [PATCH] ci(security): pin and verify the Trivy installer The Trivy install step piped a script fetched from a tag straight into a shell. A tag can be moved to other content, so the job ran whatever the ref pointed at, with the runner's privileges, and the Scorecard check flagged it as an unpinned download-then-run. The script now comes from the commit the tag points at, is checked against its SHA-256 before it runs, and the binary version stays what it was. --- .github/workflows/security.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 744c56056..5037c89d7 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -160,12 +160,25 @@ jobs: # with) answering with a corrupt index failed the step twice in a row # on a release commit. The installer downloads the tarball for this # exact version and checks it against the published checksums. + # + # The installer itself is fetched from a COMMIT and verified before it + # runs. A tag can be moved to other content, and piping a moving ref + # straight into a shell runs whatever the ref points at that morning + # with the runner's privileges. `TRIVY_INSTALL_COMMIT` is the commit + # `v0.74.0` points at; bump both together, and take the new checksum + # from the file at that commit. - name: Install Trivy env: TRIVY_VERSION: v0.74.0 + TRIVY_INSTALL_COMMIT: e1fd17a0ea4a8cf24bc4b4dd7e2cfbf4bb31b994 + TRIVY_INSTALL_SHA256: e00df553be558995b994758bc8995956554a16937f456dc6615b0cc411bfec7a run: | - curl -sfL "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" \ - | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}" + curl -sfL \ + "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_INSTALL_COMMIT}/contrib/install.sh" \ + -o trivy-install.sh + echo "${TRIVY_INSTALL_SHA256} trivy-install.sh" | sha256sum -c - + sh trivy-install.sh -b /usr/local/bin "${TRIVY_VERSION}" + rm trivy-install.sh trivy --version # Blocking since v1.15.20 — a HIGH/CRITICAL finding in the built