Print hashes to the GitHub Action log while preparing a release draft#599
Merged
Joohansson merged 1 commit intoNault:masterfrom Aug 18, 2023
nanogarden:print_hashes_PR
Merged
Print hashes to the GitHub Action log while preparing a release draft#599Joohansson merged 1 commit intoNault:masterfrom nanogarden:print_hashes_PR
Joohansson merged 1 commit intoNault:masterfrom
nanogarden:print_hashes_PR
Conversation
Member
|
@nanogarden Seems to work fine. The github build log show same hash as when doublechecking the built executables. But the actual hash files appended to the release, for example latest.yml (for windows) show something completely different. I can't figure out why. |
Member
|
Never mind, I was looking in the wrong file. It's checksums-1.18.2-windows.txt That is correct |
Author
|
Happy that it checks out. Thank you for implementing this! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Currently, the GitHub Action will compute the file hashes and append them to the checksum file. However, it is trivial to tamper with the executables and the checskum files before finalizing the release. GitHub does not provide a way to check whether this has happened - at least not one that I know of.
By using "tee" to pipe the hashes to the GitHub Action log while simultaneously appending them to the file, one can use GitHub as a third-party verifier of the integrity of the build.
This very simple modification significantly reduces the amount of trust a user has to place on the maintainers of Nault or any of its future forks.
An example of this modification in practice can be seen in these logs, under the "Create Hashes" section: https://github.com/nanogarden/Nault/actions/runs/5866326649/job/15904942936
Here is a screenshot: