Verify artifact sha256 digest before extraction (#1) #4

Merged

stephen merged 1 commit from feat/1-verify-digest into main

2026-06-16 23:45:34 +00:00

stephen commented

2026-06-16 23:42:02 +00:00

Owner

What changed
upload-artifact records a digest: sha256:<hex> in the metadata sidecar, but download fetched the archive and handed it straight to extraction without checking it. A corrupt or tampered object in shared storage was unpacked verbatim. The downloaded archive is now hashed and compared to the recorded digest before the tar step, so a bad object fails the step and leaves the destination untouched.

Recompute the archive sha256 and refuse to extract on mismatch.
Refuse a sidecar that records an empty or unrecognized digest (fail closed): a digest was expected but is missing or unusable.
Keep backward compatibility: a sidecar with no digest field still extracts, with a warning that integrity was not verified.
Verification runs before extraction, consistent with the tar-entry validation already in place.

How it was tested

make lint clean (actionlint/yq not installed locally; skipped)
make test green
new behavior has tests: matching digest verifies and extracts; mismatched digest is refused and nothing is written; absent digest extracts with a warning (legacy); empty and unrecognized digests are refused

CHANGELOG updated? yes

Closes #1

**What changed** upload-artifact records a `digest: sha256:<hex>` in the metadata sidecar, but download fetched the archive and handed it straight to extraction without checking it. A corrupt or tampered object in shared storage was unpacked verbatim. The downloaded archive is now hashed and compared to the recorded digest *before* the tar step, so a bad object fails the step and leaves the destination untouched. - Recompute the archive sha256 and refuse to extract on mismatch. - Refuse a sidecar that records an empty or unrecognized digest (fail closed): a digest was expected but is missing or unusable. - Keep backward compatibility: a sidecar with no `digest` field still extracts, with a warning that integrity was not verified. - Verification runs before extraction, consistent with the tar-entry validation already in place. **How it was tested** - [x] `make lint` clean (actionlint/yq not installed locally; skipped) - [x] `make test` green - [x] new behavior has tests: matching digest verifies and extracts; mismatched digest is refused and nothing is written; absent digest extracts with a warning (legacy); empty and unrecognized digests are refused **CHANGELOG updated?** yes Closes #1

stephen added 1 commit

2026-06-16 23:42:02 +00:00

Verify artifact sha256 digest before extraction (#1 )

test / unit (pull_request) Successful in 5s

Details

test / e2e (pull_request) Successful in 4s

Details

3f16fe99e6

upload-artifact records a sha256 digest in the metadata sidecar, but
download fetched the archive and extracted it without checking. A corrupt
or tampered object in shared storage was unpacked verbatim.

The downloaded archive is now hashed and compared to the recorded digest
before extraction, so a bad object leaves the destination untouched.

- Recompute the archive sha256 and refuse to extract on mismatch.
- Refuse a sidecar that records an empty or unrecognized digest (fail
  closed): a digest was expected but is missing or unusable.
- Keep backward compatibility: a sidecar with no digest field still
  extracts, with a warning that integrity was not verified.

stephen merged commit f9f9cbe566 into main

2026-06-16 23:45:34 +00:00

stephen referenced this pull request from a commit

2026-06-16 23:45:34 +00:00

Verify artifact sha256 digest before extraction (#1) (#4)