From 78ef4d1c2aa70a03267ac224dfb59ce870347b1d Mon Sep 17 00:00:00 2001 From: Johannes Zorn Date: Mon, 9 Nov 2026 12:42:32 +0100 Subject: [PATCH] fix(ci): install a pinned and checksum-verified trivy instead of the apt repository The dev tools script added Aqua's apt repository and installed whatever trivy version apt resolved at job time. That is the path of the March 2026 trivy compromise, and Renovate cannot see it. The script now downloads trivy v0.76.1 from GitHub releases and checks its SHA-256 (x86_64 and ARM64) before it goes on the PATH. Renovate tracks the version through the org's annotated version manager. OP-3653. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/_install_dev_tools.bash | 35 +++++++++++++++++++---- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/.github/workflows/_install_dev_tools.bash b/.github/workflows/_install_dev_tools.bash index e6926e494..bf5149087 100755 --- a/.github/workflows/_install_dev_tools.bash +++ b/.github/workflows/_install_dev_tools.bash @@ -15,12 +15,37 @@ log "Starting installation of development tools..." sudo rm -f /var/lib/man-db/auto-update # Install APT packages -# Use signed-by to add GPG key securely (apt-key is deprecated) -mkdir -p /etc/apt/keyrings -wget --secure-protocol=TLSv1_2 --max-redirect=0 -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /etc/apt/keyrings/trivy.gpg > /dev/null -echo "deb [signed-by=/etc/apt/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list sudo apt-get update -sudo apt-get install --no-install-recommends -y curl gnupg2 jq trivy xsltproc +sudo apt-get install --no-install-recommends -y curl gnupg2 jq xsltproc + +# Install Trivy: one fixed release, checked against its SHA-256 before it goes on the PATH. +# Not from Aqua's apt repository: apt would install whatever version it resolves at job time. +# When Renovate bumps the version, update both checksums from trivy__checksums.txt of that release. +# renovate: datasource=github-releases depName=aquasecurity/trivy +TRIVY_VERSION=v0.76.1 +case "$(uname -m)" in + x86_64) + trivy_arch="64bit" + TRIVY_SHA256="c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0" # trivy_0.76.1_Linux-64bit.tar.gz + ;; + aarch64 | arm64) + trivy_arch="ARM64" + TRIVY_SHA256="e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f" # trivy_0.76.1_Linux-ARM64.tar.gz + ;; + *) + echo "No Trivy checksum for architecture $(uname -m)" >&2 + exit 1 + ;; +esac +trivy_tmp="$(mktemp -d)" +trivy_tar="trivy_${TRIVY_VERSION#v}_Linux-${trivy_arch}.tar.gz" +curl --proto '=https' --tlsv1.2 -fsSL -o "${trivy_tmp}/${trivy_tar}" \ + "https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/${trivy_tar}" +echo "${TRIVY_SHA256} ${trivy_tmp}/${trivy_tar}" | sha256sum --check --strict +tar -xzf "${trivy_tmp}/${trivy_tar}" -C "${trivy_tmp}" trivy +sudo install -m 0755 "${trivy_tmp}/trivy" /usr/local/bin/trivy +rm -rf "${trivy_tmp}" +trivy --version # Install further tools not project specific # Download Sentry CLI securely: enforce HTTPS, disable redirects