Skip to content

Repository navigation

fix(ci): install a pinned and checksum-verified trivy instead of the apt repository #772

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
olivermeyer merged 1 commit into from
Nov 9, 2026
Merged

fix(ci): install a pinned and checksum-verified trivy instead of the apt repository #772

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 30 additions & 5 deletions .github/workflows/_install_dev_tools.bash
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,37 @@ log "Starting installation of development tools..."
sudo rm -f /var/lib/man-db/auto-update

# Install APT packages
# Use signed-by to add GPG key securely (apt-key is deprecated)
mkdir -p /etc/apt/keyrings
wget --secure-protocol=TLSv1_2 --max-redirect=0 -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /etc/apt/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install --no-install-recommends -y curl gnupg2 jq trivy xsltproc
sudo apt-get install --no-install-recommends -y curl gnupg2 jq xsltproc

# Install Trivy: one fixed release, checked against its SHA-256 before it goes on the PATH.
# Not from Aqua's apt repository: apt would install whatever version it resolves at job time.
# When Renovate bumps the version, update both checksums from trivy_<version>_checksums.txt of that release.
# renovate: datasource=github-releases depName=aquasecurity/trivy
TRIVY_VERSION=v0.76.1
case "$(uname -m)" in
x86_64)
trivy_arch="64bit"
TRIVY_SHA256="c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0" # trivy_0.76.1_Linux-64bit.tar.gz
;;
aarch64 | arm64)
trivy_arch="ARM64"
TRIVY_SHA256="e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f" # trivy_0.76.1_Linux-ARM64.tar.gz
;;
*)
echo "No Trivy checksum for architecture $(uname -m)" >&2
exit 1
;;
esac
trivy_tmp="$(mktemp -d)"
trivy_tar="trivy_${TRIVY_VERSION#v}_Linux-${trivy_arch}.tar.gz"
curl --proto '=https' --tlsv1.2 -fsSL -o "${trivy_tmp}/${trivy_tar}" \
"https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/${trivy_tar}"
echo "${TRIVY_SHA256} ${trivy_tmp}/${trivy_tar}" | sha256sum --check --strict
tar -xzf "${trivy_tmp}/${trivy_tar}" -C "${trivy_tmp}" trivy
sudo install -m 0755 "${trivy_tmp}/trivy" /usr/local/bin/trivy
rm -rf "${trivy_tmp}"
trivy --version

# Install further tools not project specific
# Download Sentry CLI securely: enforce HTTPS, disable redirects
Expand Down
Loading