Uh oh!
There was an error while loading. Please reload this page.
ci: add zizmor workflow security audits - #169
Conversation
| run: | | ||
| archive="$RUNNER_TEMP/zizmor.tar.gz" | ||
| curl -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o "$archive" | ||
| echo "${ZIZMOR_SHA256} $archive" | sha256sum --check | ||
| tar -xzf "$archive" -C "$RUNNER_TEMP" | ||
There was a problem hiding this comment.
Binary, code or archive is pulled from a remote source without integrity verification - medium severity
A GitHub Actions Workflow was built using an artifact from a remote source without any integrity verification. If the remote artifact were silently replaced with a malicious version (for example, through a supply chain attack), the integrity and confidentiality of the environment in which the container is deployed could be compromised.
Show fix
Remediation: Validate the artifact against a trusted SHA-512 checksum in the CI/CD pipeline using sha512sum in check mode. Store the expected checksum in a file (e.g., artifact.sha512), then verify it with: sha512sum -c artifact.sha512. Enable strict error handling (for example, set -e in shell scripts) so the pipeline fails if verification fails or outputs errors.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
There was a problem hiding this comment.
Aikido Security (@AikidoSec) ignore: The downloaded Zizmor archive is already verified immediately after download with sha256sum --check against the pinned SHA-256 digest, before extraction.
There was a problem hiding this comment.
✅ Based on your feedback, we ignored this issue because of the following reason:
The downloaded Zizmor archive is already verified immediately after download with sha256sum --check against the pinned SHA-256 digest, before extraction.
Stack
This PR is stacked on the Actionlint PR: #168
Summary
zizmorcore/zizmor-actionVerification