Added checksum validation for codecov scripts

freedomofpress · Apr 19, 2021 · cfd4822 · cfd4822
1 parent fedce7a
commit cfd4822
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 2 deletions.
diff --git a/securedrop/bin/dev-shell b/securedrop/bin/dev-shell
@@ -61,7 +61,15 @@ function docker_run() {
 
     # If this is a CI run, pass CodeCov settings into the container.
     if [ -n "${CIRCLE_BRANCH:-}" ] ; then
-        ci_env=$(bash <(curl -s https://codecov.io/env))
+        tmpdir=$(mktemp -d -t codecov-XXXX)
+        curl -s https://codecov.io/bash > $tmpdir/codecov;
+        curl -s https://codecov.io/env > $tmpdir/env;
+        VERSION=$(curl --silent "https://api.github.com/repos/codecov/codecov-bash/releases/latest" | grep '"tag_name":' |sed -E 's/.*"([^"]+)".*/\1/')
+        curl -s https://raw.githubusercontent.com/codecov/codecov-bash/"${VERSION}"/SHA256SUM > $tmpdir/codecov-hashes
+        pushd $tmpdir && shasum -a 256 -c --ignore-missing codecov-hashes && popd
+        chmod +x $tmpdir/env
+
+        ci_env=$(/bin/bash $tmpdir/env)
     else
         ci_env=""
     fi

diff --git a/securedrop/bin/run-test b/securedrop/bin/run-test
@@ -26,7 +26,13 @@ if [ -n "${CIRCLE_BRANCH:-}" ] ; then
     touch tests/log/firefox.log
     function finish {
         cp tests/log/firefox.log ../test-results
-        bash <(curl -s https://codecov.io/bash -cF "$BASE_OS")
+        tmpdir=$(mktemp -d -t codecov-XXXX)
+        curl -s https://codecov.io/bash > $tmpdir/codecov;
+        VERSION=$(curl --silent "https://api.github.com/repos/codecov/codecov-bash/releases/latest" | grep '"tag_name":' |sed -E 's/.*"([^"]+)".*/\1/')
+        curl -s https://raw.githubusercontent.com/codecov/codecov-bash/"${VERSION}"/SHA256SUM > $tmpdir/codecov-hashes
+        pushd $tmpdir && shasum -a 256 -c --ignore-missing codecov-hashes && popd
+        chmod +x $tmpdir/codecov
+        /bin/bash $tmpdir/codecov
     }
     trap finish EXIT
 fi