security: sign juliaup SHA256SUMS and verify Julia tarball hashes - #1457
Draft
IanButterworth wants to merge 1 commit into
Draft
security: sign juliaup SHA256SUMS and verify Julia tarball hashes#1457IanButterworth wants to merge 1 commit into
IanButterworth wants to merge 1 commit into
Conversation
juliaup SHA256SUMS signing (non-Windows): - CI package-unix job now signs the SHA256SUMS file immediately after creating it; the .minisig is uploaded to S3 alongside the archives. - download_sha256sums_entry fetches <url>.minisig, verifies the signature against the JULIAUP_MINISIGN_PUBLIC_KEY constant embedded in operations.rs, then returns the hash. Bails before touching disk if the signature is invalid. - JULIAUP_MINISIGN_SECRET_KEY Actions secret (package environment) holds the private key; the public key is baked into the binary. - Adds minisign-verify = "0.2" (non-Windows only). Julia tarball SHA256 verification (non-Windows, non-macOS): - JuliaupVersionDBVersion gains an optional Sha256 field. - updateversiondb.jl now emits "Sha256" from the upstream versions.json (was already fetched but discarded). - install_version uses download_extract_sans_parent_verified when the DB entry carries a Sha256; falls back to the unverified path for older entries that predate the field. Co-Authored-By: Claude <claude@users.noreply.github.com>
Member
|
clippy test fails |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On top of #1455 and #1456.
Developed with Claude:
What this adds
Signature verification for the SHA256SUMS file (non-Windows)
The unsigned SHA256SUMS file introduced in #1456 could itself be replaced by a server-side attacker. This PR closes that gap:
minisign. The public key is embedded asJULIAUP_MINISIGN_PUBLIC_KEYinsrc/operations.rs.package-unix) signs the SHA256SUMS file immediately after creating it; the.minisigis uploaded to S3 alongside the archives.download_sha256sums_entrynow fetches<url>.minisigfirst, verifies the signature against the embedded key, and only then returns the hash. An invalid signature is a hard error before any bytes touch disk.minisign-verify = "0.2"(non-Windows only).JULIAUP_MINISIGN_SECRET_KEYsecret in the GitHubpackageActions environment before releasing.SHA256 verification extended to Julia version tarballs (non-Windows, non-macOS)
JuliaupVersionDBVersiongains an optionalSha256field.updateversiondb.jlnow emits"Sha256"from the upstreamversions.json(the value was already fetched but discarded).install_versioncallsdownload_extract_sans_parent_verifiedwhen the DB entry includes a hash; falls back to the unverified path for older entries that predate the field.