Verify artifact sha256 digest before extraction #1

New issue

Closed

opened 2026-06-16 17:54:53 +00:00 by stephen · 0 comments

stephen commented

2026-06-16 17:54:53 +00:00

Owner

Why

upload-artifact writes a digest field in metadata, but download-artifact ignores it and extracts the downloaded archive directly.

Verified

upload-artifact-action/src/lib/upload-impl.js writes digest: sha256:... into metadata.
download-artifact-action/src/lib/download-impl.js loads only object/method/name and never checks digest.
No existing download-artifact-action issues are filed.

Build

Load the digest from metadata and hash the archive before extraction.
Fail closed on mismatch, with a compatibility path for legacy metadata without digest.
Add corrupt-object tests.

## Why upload-artifact writes a `digest` field in metadata, but download-artifact ignores it and extracts the downloaded archive directly. ## Verified - `upload-artifact-action/src/lib/upload-impl.js` writes `digest: sha256:...` into metadata. - `download-artifact-action/src/lib/download-impl.js` loads only object/method/name and never checks digest. - No existing download-artifact-action issues are filed. ## Build - Load the digest from metadata and hash the archive before extraction. - Fail closed on mismatch, with a compatibility path for legacy metadata without digest. - Add corrupt-object tests.

stephen added the

opportunity

labels

2026-06-16 17:54:53 +00:00

stephen referenced this issue from a commit

2026-06-16 23:41:54 +00:00

Verify artifact sha256 digest before extraction (#1)

stephen referenced this issue from a pull request that will close it,

2026-06-16 23:42:02 +00:00

Verify artifact sha256 digest before extraction (#1) #4

stephen closed this issue

2026-06-16 23:45:34 +00:00