Skip to content

Commit 50895b2

Browse files
thomasrockhuthomasrockhu
committed
Pull checksums into script
1 parent 95e6f30 commit 50895b2

5 files changed

Lines changed: 116 additions & 163 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## 1.4.1
22
## Fixes
3-
- #287 Update VERSION regex to restrict on digits and dot
3+
- #287 Update VERSION regex to restrict on digits and dot and move checksums into script
44

55
## 1.4.0
66
### Features

‎dist/index.js‎

Lines changed: 77 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -13203,66 +13203,58 @@ try {
1320313203
timeout: 3000,
1320413204
url: 'https://codecov.io/bash',
1320513205
}, function (error, response, body) { return __awaiter(void 0, void 0, void 0, function () {
13206-
var _a, execArgs, options, filepath, failCi, isValid, failure, error_1;
13206+
var _a, execArgs, options, filepath, failCi, isValid, failure;
1320713207
return __generator(this, function (_b) {
13208-
switch (_b.label) {
13209-
case 0:
13210-
_a = buildExec_1["default"](), execArgs = _a.execArgs, options = _a.options, filepath = _a.filepath, failCi = _a.failCi;
13211-
_b.label = 1;
13212-
case 1:
13213-
_b.trys.push([1, 3, , 4]);
13214-
return [4 /*yield*/, validate_1["default"](body)];
13215-
case 2:
13216-
isValid = _b.sent();
13217-
if (!isValid) {
13218-
failure = 'Codecov failure: ' +
13219-
'Bash script checksums do not match published values. ' +
13220-
'Please contact security@codecov.io immediately.';
13221-
core.setFailed(failure);
13222-
throw new Error(failure);
13223-
}
13224-
if (error && failCi) {
13225-
throw error;
13208+
_a = buildExec_1["default"](), execArgs = _a.execArgs, options = _a.options, filepath = _a.filepath, failCi = _a.failCi;
13209+
try {
13210+
isValid = validate_1["default"](body);
13211+
if (!isValid) {
13212+
failure = 'Codecov failure: ' +
13213+
'Bash script checksums do not match published values. ' +
13214+
'Please contact security@codecov.io immediately.';
13215+
core.setFailed(failure);
13216+
throw new Error(failure);
13217+
}
13218+
if (error && failCi) {
13219+
throw error;
13220+
}
13221+
else if (error) {
13222+
core.warning("Codecov warning: " + error.message);
13223+
}
13224+
fs.writeFile(filepath, body, function (err) {
13225+
if (err && failCi) {
13226+
throw err;
1322613227
}
13227-
else if (error) {
13228-
core.warning("Codecov warning: " + error.message);
13228+
else if (err) {
13229+
core.warning("Codecov warning: " + err.message);
1322913230
}
13230-
fs.writeFile(filepath, body, function (err) {
13231-
if (err && failCi) {
13232-
throw err;
13231+
exec.exec('bash', execArgs, options)["catch"](function (err) {
13232+
if (failCi) {
13233+
core.setFailed("Codecov failed with the following error: " + err.message);
1323313234
}
13234-
else if (err) {
13235+
else {
1323513236
core.warning("Codecov warning: " + err.message);
1323613237
}
13237-
exec.exec('bash', execArgs, options)["catch"](function (err) {
13238-
if (failCi) {
13239-
core.setFailed("Codecov failed with the following error: " + err.message);
13238+
})
13239+
.then(function () {
13240+
unlinkFile();
13241+
});
13242+
var unlinkFile = function () {
13243+
fs.unlink(filepath, function (err) {
13244+
if (err && failCi) {
13245+
throw err;
1324013246
}
13241-
else {
13247+
else if (err) {
1324213248
core.warning("Codecov warning: " + err.message);
1324313249
}
13244-
})
13245-
.then(function () {
13246-
unlinkFile();
1324713250
});
13248-
var unlinkFile = function () {
13249-
fs.unlink(filepath, function (err) {
13250-
if (err && failCi) {
13251-
throw err;
13252-
}
13253-
else if (err) {
13254-
core.warning("Codecov warning: " + err.message);
13255-
}
13256-
});
13257-
};
13258-
});
13259-
return [3 /*break*/, 4];
13260-
case 3:
13261-
error_1 = _b.sent();
13262-
core.setFailed("Codecov failed with the following error: " + error_1.message);
13263-
return [3 /*break*/, 4];
13264-
case 4: return [2 /*return*/];
13251+
};
13252+
});
1326513253
}
13254+
catch (error) {
13255+
core.setFailed("Codecov failed with the following error: " + error.message);
13256+
}
13257+
return [2 /*return*/];
1326613258
});
1326713259
}); });
1326813260
}
@@ -49178,106 +49170,53 @@ module.exports = function (data, opts) {
4917849170

4917949171
"use strict";
4918049172

49181-
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
49182-
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
49183-
return new (P || (P = Promise))(function (resolve, reject) {
49184-
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
49185-
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
49186-
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
49187-
step((generator = generator.apply(thisArg, _arguments || [])).next());
49188-
});
49189-
};
49190-
var __generator = (this && this.__generator) || function (thisArg, body) {
49191-
var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
49192-
return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
49193-
function verb(n) { return function (v) { return step([n, v]); }; }
49194-
function step(op) {
49195-
if (f) throw new TypeError("Generator is already executing.");
49196-
while (_) try {
49197-
if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
49198-
if (y = 0, t) op = [op[0] & 2, t.value];
49199-
switch (op[0]) {
49200-
case 0: case 1: t = op; break;
49201-
case 4: _.label++; return { value: op[1], done: false };
49202-
case 5: _.label++; y = op[1]; op = [0]; continue;
49203-
case 7: op = _.ops.pop(); _.trys.pop(); continue;
49204-
default:
49205-
if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
49206-
if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
49207-
if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
49208-
if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
49209-
if (t[2]) _.ops.pop();
49210-
_.trys.pop(); continue;
49211-
}
49212-
op = body.call(thisArg, _);
49213-
} catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
49214-
if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
49215-
}
49216-
};
4921749173
exports.__esModule = true;
4921849174
exports.retrieveChecksum = void 0;
4921949175
var crypto = __webpack_require__(417);
4922049176
var core = __webpack_require__(470);
4922149177
var request = __webpack_require__(335);
49222-
var validateUploader = function (body) { return __awaiter(void 0, void 0, void 0, function () {
49223-
var version, _i, _a, i, publicChecksum, uploaderChecksum;
49224-
return __generator(this, function (_b) {
49225-
switch (_b.label) {
49226-
case 0:
49227-
version = getVersion(body);
49228-
if (version === null) {
49229-
core.warning('Codecov could not identify the bash uploader version.');
49230-
return [2 /*return*/, false];
49231-
}
49232-
_i = 0, _a = [1, 256, 512];
49233-
_b.label = 1;
49234-
case 1:
49235-
if (!(_i < _a.length)) return [3 /*break*/, 4];
49236-
i = _a[_i];
49237-
return [4 /*yield*/, exports.retrieveChecksum(version, i)];
49238-
case 2:
49239-
publicChecksum = _b.sent();
49240-
uploaderChecksum = calculateChecksum(body, i);
49241-
if (uploaderChecksum !== publicChecksum.trim()) {
49242-
core.warning("Codecov " + version + " checksums for SHA" + i + " failed to match.\n" +
49243-
("Public checksum: " + publicChecksum) +
49244-
("Uploader checksum: " + uploaderChecksum));
49245-
return [2 /*return*/, false];
49246-
}
49247-
_b.label = 3;
49248-
case 3:
49249-
_i++;
49250-
return [3 /*break*/, 1];
49251-
case 4: return [2 /*return*/, true];
49178+
var validateUploader = function (body) {
49179+
var version = getVersion(body);
49180+
if (version === null) {
49181+
core.warning('Codecov could not identify the bash uploader version.');
49182+
return false;
49183+
}
49184+
for (var _i = 0, _a = [1, 256, 512]; _i < _a.length; _i++) {
49185+
var i = _a[_i];
49186+
var publicChecksum = exports.retrieveChecksum(version, i);
49187+
var uploaderChecksum = calculateChecksum(body, i);
49188+
if (uploaderChecksum !== publicChecksum) {
49189+
core.warning("Codecov " + version + " checksums for SHA" + i + " failed to match.\n" +
49190+
("Public checksum: " + publicChecksum) +
49191+
("Uploader checksum: " + uploaderChecksum));
49192+
return false;
4925249193
}
49253-
});
49254-
}); };
49255-
var retrieveChecksum = function (version, encryption) { return __awaiter(void 0, void 0, void 0, function () {
49256-
var url, response;
49257-
return __generator(this, function (_a) {
49258-
switch (_a.label) {
49259-
case 0:
49260-
url = "https://raw.githubusercontent.com/codecov/codecov-bash/" + version + "/SHA" + encryption + "SUM";
49261-
return [4 /*yield*/, request({
49262-
maxAttempts: 10,
49263-
timeout: 3000,
49264-
url: url,
49265-
})];
49266-
case 1:
49267-
response = _a.sent();
49268-
if (response.statusCode != 200) {
49269-
core.warning("Codecov could not retrieve checksum SHA" + encryption + " at " + url);
49270-
return [2 /*return*/, ''];
49271-
}
49272-
return [2 /*return*/, response.body];
49194+
}
49195+
return true;
49196+
};
49197+
var retrieveChecksum = function (version, encryption) {
49198+
var checksums = {
49199+
'1.0.1': {
49200+
'1': '0ddc61a9408418c73b19a1375f63bb460dc947a8',
49201+
'256': '89c658e261d5f25533598a222fd96cf17a5fa0eb3772f2defac754d9970b2ec8',
49202+
'512': 'd075b412a362a9a2b7aedfec3b8b9a9a927b3b99e98c7c15a2b76ef09862aeb005e91d76a5fd71b511141496d0fd23d1b42095f722ebcd509d768fba030f159e',
49203+
},
49204+
'1.0.2': {
49205+
'1': '537069158a6f72b145cfe5f782dceb608d9ef594',
49206+
'256': 'd6aa3207c4908d123bd8af62ec0538e3f2b9f257c3de62fad4e29cd3b59b41d9',
49207+
'512': 'b6492196dd844cd81a688536bb42463d28bd666448335c4a8fc7f8f9b9b9afc346a467e3401e3fc49e6047442a30d93a4adfaa1590101224a186013c6179c48d',
4927349208
}
49274-
});
49275-
}); };
49209+
};
49210+
if (version in checksums && encryption in checksums[version]) {
49211+
return checksums[version][encryption];
49212+
}
49213+
return null;
49214+
};
4927649215
exports.retrieveChecksum = retrieveChecksum;
4927749216
var calculateChecksum = function (body, i) {
4927849217
var shasum = crypto.createHash("sha" + i);
4927949218
shasum.update(body);
49280-
return shasum.digest('hex') + " codecov";
49219+
return "" + shasum.digest('hex');
4928149220
};
4928249221
var getVersion = function (body) {
4928349222
var regex = /VERSION="([\d\.]+)"/g;

‎src/index.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ try {
1818
const {execArgs, options, filepath, failCi} = buildExec();
1919

2020
try {
21-
const isValid = await validateUploader(body);
21+
const isValid = validateUploader(body);
2222
if (!isValid) {
2323
const failure = 'Codecov failure: ' +
2424
'Bash script checksums do not match published values. ' +

‎src/validate.test.ts‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,23 +17,34 @@ const bashScript = (async () => {
1717
});
1818

1919
test('valid checksums', async () => {
20-
const valid = await validateUploader(await bashScript());
20+
const valid = validateUploader(await bashScript());
2121
expect(valid).toBeTruthy();
2222
});
2323

2424
test('invalid checksums', async () => {
2525
const script = await bashScript();
26-
const valid = await validateUploader(script.substring(0, script.length - 1));
26+
const valid = validateUploader(script.substring(0, script.length - 1));
2727
expect(valid).toBeFalsy();
2828
});
2929

3030
test('invalid script version', async () => {
3131
const script = await bashScript();
32-
const valid = await validateUploader(script.substring(0, 20));
32+
const valid = validateUploader(script.substring(0, 20));
3333
expect(valid).toBeFalsy();
3434
});
3535

36-
test('invalid public checksum file', async () => {
37-
const checksum = await retrieveChecksum('foo', 'bar');
36+
test('invalid public checksum file', () => {
37+
const checksum = retrieveChecksum('foo', 'bar');
3838
expect(checksum).toBeFalsy();
3939
});
40+
41+
test('invalid public checksum file', () => {
42+
const checksum = retrieveChecksum('foo', 'bar');
43+
expect(checksum).toBeFalsy();
44+
});
45+
46+
test('invalid encryption', () => {
47+
const checksum = retrieveChecksum('1.0.1', 'foo');
48+
expect(checksum).toBeFalsy();
49+
});
50+

‎src/validate.ts‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,17 @@ const core = require('@actions/core');
44

55
const request = require('requestretry');
66

7-
const validateUploader = async (body) => {
7+
const validateUploader = (body) => {
88
const version = getVersion(body);
99
if (version === null) {
1010
core.warning('Codecov could not identify the bash uploader version.');
1111
return false;
1212
}
1313

1414
for (const i of [1, 256, 512]) {
15-
const publicChecksum = await retrieveChecksum(version, i);
15+
const publicChecksum = retrieveChecksum(version, i);
1616
const uploaderChecksum = calculateChecksum(body, i);
17-
if (uploaderChecksum !== publicChecksum.trim()) {
17+
if (uploaderChecksum !== publicChecksum) {
1818
core.warning(
1919
`Codecov ${version} checksums for SHA${i} failed to match.\n` +
2020
`Public checksum: ${publicChecksum}` +
@@ -26,27 +26,30 @@ const validateUploader = async (body) => {
2626
return true;
2727
};
2828

29-
export const retrieveChecksum = async (version, encryption) => {
30-
const url = `https://raw.githubusercontent.com/codecov/codecov-bash/${version}/SHA${encryption}SUM`;
31-
const response = await request({
32-
maxAttempts: 10,
33-
timeout: 3000,
34-
url: url,
35-
});
36-
37-
if (response.statusCode != 200) {
38-
core.warning(
39-
`Codecov could not retrieve checksum SHA${encryption} at ${url}`,
40-
);
41-
return '';
29+
export const retrieveChecksum = (version, encryption) => {
30+
const checksums = {
31+
'1.0.1': {
32+
'1': '0ddc61a9408418c73b19a1375f63bb460dc947a8',
33+
'256': '89c658e261d5f25533598a222fd96cf17a5fa0eb3772f2defac754d9970b2ec8',
34+
'512': 'd075b412a362a9a2b7aedfec3b8b9a9a927b3b99e98c7c15a2b76ef09862aeb005e91d76a5fd71b511141496d0fd23d1b42095f722ebcd509d768fba030f159e',
35+
},
36+
'1.0.2': {
37+
'1': '537069158a6f72b145cfe5f782dceb608d9ef594',
38+
'256': 'd6aa3207c4908d123bd8af62ec0538e3f2b9f257c3de62fad4e29cd3b59b41d9',
39+
'512': 'b6492196dd844cd81a688536bb42463d28bd666448335c4a8fc7f8f9b9b9afc346a467e3401e3fc49e6047442a30d93a4adfaa1590101224a186013c6179c48d',
40+
}
41+
};
42+
43+
if (version in checksums && encryption in checksums[version]) {
44+
return checksums[version][encryption];
4245
}
43-
return response.body;
46+
return null;
4447
};
4548

4649
const calculateChecksum = (body, i) => {
4750
const shasum = crypto.createHash(`sha${i}`);
4851
shasum.update(body);
49-
return `${shasum.digest('hex')} codecov`;
52+
return `${shasum.digest('hex')}`;
5053
};
5154

5255
const getVersion = (body) => {

0 commit comments

Comments
 (0)