webgrip/infrastructure
5
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases 102 Packages Wiki Activity Actions

fix(helm-deploy): verify all five tool downloads #117

Merged
ryangr0 merged 1 commit from fix/helm-deploy-verify-downloads into main 2026-08-08 13:17:05 +00:00
Conversation 0 Commits 1 Files changed 1 +36 -14
ryangr0 commented 2026-08-08 06:35:49 +00:00
Owner
Copy link

kubectl, helm, doctl, yq and sops all installed unverified — and this image's whole job is holding credentials that can deploy to the cluster. A tampered kubectl or sops here is a cluster compromise, not a CI inconvenience. helm additionally arrived via curl | bash of get-helm-3 fetched from helm's master branch.

Now, per ci-runner's #88 pattern:

  • every tool is a pinned release artifact with its published sha256 checked before install
  • helm comes as the release tarball directly — no installer script
  • sops fetches from getsops/ (the mozilla/ org is a redirect that will not live forever)
  • the never-exercised latest branches are gone; the pinned path is the only path
  • a final RUN asserts all five binaries actually execute
  • Renovate annotations on every version; a bump without its checksum fails the build rather than shipping unverified

Today's measurement run puts the stale 1.2.2 tag at 21 critical / 105 high — most of that is tool binaries frozen in time. With Renovate actually moving these (#106), that stops recurring.

Generated with Claude Code

kubectl, helm, doctl, yq and sops all installed **unverified** — and this image's whole job is holding credentials that can deploy to the cluster. A tampered kubectl or sops here is a cluster compromise, not a CI inconvenience. helm additionally arrived via `curl | bash` of get-helm-3 fetched from helm's **master branch**. Now, per ci-runner's #88 pattern: - every tool is a pinned release artifact with its published sha256 checked before install - helm comes as the release tarball directly — no installer script - sops fetches from `getsops/` (the `mozilla/` org is a redirect that will not live forever) - the never-exercised `latest` branches are gone; the pinned path is the only path - a final `RUN` asserts all five binaries actually execute - Renovate annotations on every version; a bump without its checksum **fails the build** rather than shipping unverified Today's measurement run puts the stale 1.2.2 tag at 21 critical / 105 high — most of that is tool binaries frozen in time. With Renovate actually moving these (#106), that stops recurring. Generated with [Claude Code](https://claude.com/claude-code)
fix(helm-deploy): verify all five tool downloads
All checks were successful
[Workflow] On Source Change / Guard: per-image .releaserc.cjs present (push) Successful in 18s
Details
[Workflow] On Source Change / Determine Changed Directories (push) Successful in 2m10s
Details
[Workflow] On Source Change / Determine changed images (push) Successful in 0s
Details
[Workflow] On Source Change / Resolve release matrix (push) Successful in 2s
Details
[Workflow] On Source Change / Build check (helm-deploy, ops/docker/helm-deploy) (push) Successful in 12s
Details
[Workflow] On Source Change / Release (helm-deploy, ops/docker/helm-deploy) (push) Has been skipped
Details
e647907092 
kubectl, helm, doctl, yq and sops all installed UNVERIFIED — and this image's
whole job is holding credentials that can deploy to the cluster; a tampered
kubectl or sops here is a cluster compromise, not a CI inconvenience. helm
additionally arrived via 'curl | bash' of get-helm-3 from helm's master
branch.

Now: every tool is a pinned release artifact with its published sha256
checked before install (ci-runner's #88 pattern), helm comes as the release
tarball directly, sops moves to getsops/ (the mozilla/ org is a redirect
that will not live forever), the never-exercised 'latest' branches are gone,
and a final RUN asserts all five binaries actually execute. Renovate
annotations on every version; a bump without its checksum fails the build.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
pull-request
Mirrored from GitHub Pull Request

  
released
No labels
pull-request
released
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
webgrip/infrastructure!117
No description provided.