rasterstate/download-artifact-action
2
0
Fork 0
Code Issues 4 Pull requests Projects Releases Packages Wiki Activity Actions

Harden artifact integrity checks #9

Merged
stephen merged 2 commits from feat/artifact-integrity into main 2026-06-22 20:20:50 +00:00
Conversation 0 Commits 2 Files changed 5 +35 -21
stephen commented 2026-06-22 20:08:00 +00:00
Owner
Copy link

Artifacts should not be unpacked unless their metadata proves the downloaded bytes match the upload digest. This keeps the extraction hardening covered and makes missing digests fail closed before tar validation or extraction.

What changed

  • Refuse artifacts with a missing sha256 digest, including sidecarless archive fallback downloads.
  • Keep sha256 verification before extraction and document that missing or malformed digests fail the step.
  • Add a hardlink escape regression test for the safe extraction validator.

Testing

  • Ran npm run check, npm test, git diff --check, and git diff --cached --check.

Fixes #1
Refs #2

Artifacts should not be unpacked unless their metadata proves the downloaded bytes match the upload digest. This keeps the extraction hardening covered and makes missing digests fail closed before tar validation or extraction. **What changed** - Refuse artifacts with a missing sha256 digest, including sidecarless archive fallback downloads. - Keep sha256 verification before extraction and document that missing or malformed digests fail the step. - Add a hardlink escape regression test for the safe extraction validator. **Testing** - Ran `npm run check`, `npm test`, `git diff --check`, and `git diff --cached --check`. Fixes #1 Refs #2
Fail closed on missing artifact digest
Some checks failed
test / unit (pull_request) Successful in 5s
Details
test / e2e (pull_request) Failing after 4s
Details
3bea52e03d
Seed e2e artifact with a digest so fail-closed verification passes
All checks were successful
test / unit (pull_request) Successful in 25s
Details
test / e2e (pull_request) Successful in 24s
Details
375df3c928
 
The e2e fixture wrote dist.meta.json without a digest, which the new
fail-closed integrity check correctly refuses. Real uploads always record
digest: "sha256:<hex>", so the fixture now computes and embeds it; the
missing/tampered-digest refusal stays covered by the unit tests.
stephen referenced this pull request from a commit 2026-06-22 20:20:50 +00:00
Harden artifact integrity checks (#9)
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/download-artifact-action!9
No description provided.