Skip to content

feat: verify installer downloads with cosign #5794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

feat: verify installer downloads with cosign #5794

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/post-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,4 +74,5 @@ jobs:
os: [ubuntu-latest, macos-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: sigstore/cosign-installer@v3
- run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh | sh -s -- -b "./install-golangci-lint"
1 change: 1 addition & 0 deletions .github/workflows/pr-checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ jobs:
os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- uses: sigstore/cosign-installer@v3
- uses: actions/checkout@v4
- name: Check installation script
run: cat ./install.sh | sh -s -- -d -b "./install-golangci-lint"
Expand Down
4 changes: 4 additions & 0 deletions docs/src/docs/welcome/install.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,8 @@ wget -O- -nv https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/insta
golangci-lint --version
```

If [`cosign`](https://github.com/sigstore/cosign) is installed, the installer will verify downloads with it. This is highly recommended.

It is advised that you periodically update the version of golangci-lint as the project is under active development and is constantly being improved.
For any problems with golangci-lint, check out recent [GitHub issues](https://github.com/golangci/golangci-lint/issues) and update if needed.

Expand All @@ -70,6 +72,8 @@ curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install
golangci-lint --version
```

If [`cosign`](https://github.com/sigstore/cosign) is installed, the installer will verify downloads with it. This is highly recommended.

On Windows, you can run the above commands with Git Bash, which comes with [Git for Windows](https://git-scm.com/download/win).

### Linux
Expand Down
17 changes: 17 additions & 0 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ execute() {
log_debug "downloading files into ${tmpdir}"
http_download "${tmpdir}/${TARBALL}" "${TARBALL_URL}"
http_download "${tmpdir}/${CHECKSUM}" "${CHECKSUM_URL}"
cosign_verify "${tmpdir}/${CHECKSUM}"
hash_sha256_verify "${tmpdir}/${TARBALL}" "${tmpdir}/${CHECKSUM}"
srcdir="${tmpdir}/${NAME}"
rm -rf "${srcdir}"
Expand Down Expand Up @@ -390,6 +391,20 @@ End of functions from https://github.com/client9/shlib
------------------------------------------------------------------------
EOF

cosign_verify() {
if ! is_command cosign; then
log_info "cosign is not available, skipping verify"
return 0
fi
checksums=$1
http_download "${tmpdir}/${CHECKSUM_COSIGN_BUNDLE}" "${CHECKSUM_COSIGN_BUNDLE_URL}"
Copy link
Contributor Author

@scop scop May 11, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will fail for releases that don't have hose signed checksum .cosign.bundles. I suppose we should address it somehow, but I'm not sure what would be the best way. Some thoughts:

  • Hardcode some version comparison, don't try it for versions known to not have it? This is somewhat a chore to do in the shell script.
  • Skip verify if downloading the cosign bundle fails due to HTTP 404? Not sure if there's a good way to implement that for wget.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An example of this problem can be seen in the CI failure of this PR.

cosign verify-blob \
--bundle="${tmpdir}/${CHECKSUM_COSIGN_BUNDLE}" \
--certificate-identity="https://github.com/$PREFIX/.github/workflows/release.yml@refs/tags/$TAG" \
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
"$checksums"
}

PROJECT_NAME="golangci-lint"
OWNER=golangci
REPO="golangci-lint"
Expand Down Expand Up @@ -428,6 +443,8 @@ TARBALL=${NAME}.${FORMAT}
TARBALL_URL=${GITHUB_DOWNLOAD}/${TAG}/${TARBALL}
CHECKSUM=${PROJECT_NAME}-${VERSION}-checksums.txt
CHECKSUM_URL=${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM}
CHECKSUM_COSIGN_BUNDLE=${CHECKSUM}.cosign.bundle
CHECKSUM_COSIGN_BUNDLE_URL=${CHECKSUM_URL}.cosign.bundle


execute
Loading