diff options
| author | Jonathan <jonathan@mullvad.net> | 2023-05-08 23:14:03 +0200 |
|---|---|---|
| committer | Jonathan <jonathan@mullvad.net> | 2023-05-09 09:29:53 +0200 |
| commit | c1238f96d5d3a5db338c9381b53293ff618bcc3d (patch) | |
| tree | 430074fbb2ccdfb5314936f27119362289ae3438 /.github | |
| parent | ea503921eb452e6f2916061625e5c4ca5430b108 (diff) | |
| download | mullvadvpn-c1238f96d5d3a5db338c9381b53293ff618bcc3d.tar.xz mullvadvpn-c1238f96d5d3a5db338c9381b53293ff618bcc3d.zip | |
Fix broken github CI script caused by CVE fix
The github CI code broke due to a code injection vulnerability
being fixed in a quick-and-dirty way. The dirty solution is here
cleaned up and works better than previously.
Diffstat (limited to '.github')
| -rw-r--r-- | .github/workflows/verify-locked-down-signatures.yml | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/.github/workflows/verify-locked-down-signatures.yml b/.github/workflows/verify-locked-down-signatures.yml index 459545ac4c..b246910c87 100644 --- a/.github/workflows/verify-locked-down-signatures.yml +++ b/.github/workflows/verify-locked-down-signatures.yml @@ -12,7 +12,7 @@ on: - ios/MullvadVPN.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved - android/gradle/verification-metadata.xml - android/gradle/wrapper/gradle-wrapper.properties - - building/build-and-publish.sh + - building/build-and-publish-container-image.sh - building/mullvad-app-container-signing.asc - building/linux-container-image.txt - building/android-container-image.txt @@ -27,11 +27,7 @@ jobs: ref: ${{ github.event.pull_request.head.sha }} - name: Verify signatures run: |- - commits=${{ github.event.pull_request.commits }} - if [[ -n "$commits" ]]; then - echo "Fetching $commits commits" - # FIXME: Temporarily simplified to avoid: - # https://securitylab.github.com/research/github-actions-untrusted-input/#script-injections - git fetch --depth="$(( commits + 1 ))" - fi + base_ref=${{ github.event.pull_request.base.sha }} + head_ref=${{ github.event.pull_request.head.sha }} + git fetch --no-recurse-submodules --shallow-exclude=main origin main $base_ref $head_ref ci/verify-locked-down-signatures.sh --import-gpg-keys --whitelist origin/main |