[pull] master from appleboy:master - #23
Merged
Merged
Conversation
* Verify drone-ssh binary checksum after download Download checksums.txt from the drone-ssh release alongside the binary and verify it. Protects against tampered or corrupted release artifacts. * refactor: make checksum verification portable across minimal containers - Detect shasum (Perl) or sha256sum (coreutils/busybox) and fall back gracefully; warn and skip verification only when neither tool exists, so container jobs without perl are not broken - Look up the exact checksums.txt entry for the target binary and compare hashes directly, avoiding the --ignore-missing flag that busybox sha256sum does not support - Fail closed when checksums.txt has no entry for the binary - Remove checksums.txt after successful verification Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Bo-Yi Wu <appleboy.tw@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: append .exe suffix to Windows binary download filename The drone-ssh release publishes Windows assets with an .exe suffix (e.g. drone-ssh-1.8.2-windows-amd64.exe), but entrypoint.sh built the download filename without it, so every Windows runner failed with a 404 at the download step (ERR_DOWNLOAD_FAILED). Append .exe when the detected platform is windows. This also keeps the checksums.txt lookup working on Windows since entries match the exact asset name. Add a windows-latest CI job that exercises the download, checksum verification, and binary execution path. Fixes #417 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: detect Git Bash/MSYS/Cygwin uname output as windows platform On windows-latest runners, bash steps run under Git Bash where uname -s reports MINGW64_NT-10.0-<build>, so platform detection rejected Windows runners with ERR_UNKNOWN_PLATFORM before the download step was even reached. Map mingw*/msys*/cygwin* to windows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )