chore(deps): bump the actions group with 2 updates

[dependabot]

Bumps the actions group with 2 updates: katoptra/lib/.github/actions/toolbox and katoptra/lib/.github/workflows/sync.yml.

Updates katoptra/lib/.github/actions/toolbox from 2.0.0 to 2.0.1

Release notes

Sourced from katoptra/lib/.github/actions/toolbox's releases.

v2.0.1

Two supply-chain fixes from the security review of 2026-09-08.

The AWS CLI is verified before it is installed. It was the only tool in toolchain.lock.toml carrying no checksum, installed with curl, unzip and ./aws/install as root, and it is the binary that receives the R2 credentials on every upload. AWS publishes no checksum for the v2 Linux installer, only a detached PGP signature, so the fetch stage now verifies that signature through the same GOODSIG-and-VALIDSIG gate the engine uses for TeX Live, against the key committed at docker/aws-cli.pub and the fingerprint pinned in the lock. gpgv's own verdict is not the gate: a zip signed by any other valid key still reports a good signature, and only the fingerprint comparison refuses it.

That key expires 2027-07-01. An expired key is EXPKEYSIG, not GOODSIG, so builds after that date fail closed until docker/aws-cli.pub is refreshed from the AWS CLI User Guide.

The sync workflow refuses a hostile vars input. Its words become go-task call variables, which the engine splices into shell as raw text, so a crafted RECONCILE or BATCH_GB could run arbitrary commands in the step that had already exported every inherited secret, including the R2 credentials and OP_SERVICE_ACCOUNT_TOKEN. A word that is not a bare upper-case key and a plain value is now refused at the boundary, in a step that holds no secrets. reconcile's status quotes its value as well. BATCH_GB lands inside $(( )), where a quoted operand is a syntax error, so it stays bare and carries a ponytail: comment naming what protects it.

Each guard's own cases run in CI and prove what it refuses; the image build proves what the signature gate accepts.

No mirror needs a change. Neither fix alters a rendered command, so render.txt in ctan and tlnet still matches, and the rollout is the v2 tag as usual.

Commits

• 7b7d117 fix(security): verify the AWS CLI signature, guard the vars input
• fceb64a Merge pull request #2 from katoptra/josh/docs-v2
• 83add31 docs: the include and the image float at v2
• See full diff in compare view

Updates katoptra/lib/.github/workflows/sync.yml from 2.0.0 to 2.0.1

Release notes

Sourced from katoptra/lib/.github/workflows/sync.yml's releases.

v2.0.1

Two supply-chain fixes from the security review of 2026-09-08.

The AWS CLI is verified before it is installed. It was the only tool in toolchain.lock.toml carrying no checksum, installed with curl, unzip and ./aws/install as root, and it is the binary that receives the R2 credentials on every upload. AWS publishes no checksum for the v2 Linux installer, only a detached PGP signature, so the fetch stage now verifies that signature through the same GOODSIG-and-VALIDSIG gate the engine uses for TeX Live, against the key committed at docker/aws-cli.pub and the fingerprint pinned in the lock. gpgv's own verdict is not the gate: a zip signed by any other valid key still reports a good signature, and only the fingerprint comparison refuses it.

That key expires 2027-07-01. An expired key is EXPKEYSIG, not GOODSIG, so builds after that date fail closed until docker/aws-cli.pub is refreshed from the AWS CLI User Guide.

The sync workflow refuses a hostile vars input. Its words become go-task call variables, which the engine splices into shell as raw text, so a crafted RECONCILE or BATCH_GB could run arbitrary commands in the step that had already exported every inherited secret, including the R2 credentials and OP_SERVICE_ACCOUNT_TOKEN. A word that is not a bare upper-case key and a plain value is now refused at the boundary, in a step that holds no secrets. reconcile's status quotes its value as well. BATCH_GB lands inside $(( )), where a quoted operand is a syntax error, so it stays bare and carries a ponytail: comment naming what protects it.

Each guard's own cases run in CI and prove what it refuses; the image build proves what the signature gate accepts.

No mirror needs a change. Neither fix alters a rendered command, so render.txt in ctan and tlnet still matches, and the rollout is the v2 tag as usual.

Commits

• 7b7d117 fix(security): verify the AWS CLI signature, guard the vars input
• fceb64a Merge pull request #2 from katoptra/josh/docs-v2
• 83add31 docs: the include and the image float at v2
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions