Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add checksum validation for the golangci-lint install script. #2378

Merged
merged 2 commits into from
Jan 27, 2022
Merged

Add checksum validation for the golangci-lint install script. #2378

merged 2 commits into from
Jan 27, 2022

Conversation

vinayakankugoyal
Copy link
Contributor

@vinayakankugoyal vinayakankugoyal commented Jan 5, 2022 •
edited
Loading

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

We use curl to download the golangci-lint binary but don't verify the checksum of the installation script. I added checksum validation for the installation script.

Which issue(s) this PR fixes:

None

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-priority size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 5, 2022
@k8s-ci-robot k8s-ci-robot added the sig/release Categorizes an issue or PR as relevant to SIG Release. label Jan 5, 2022
@vinayakankugoyal
Copy link
Contributor Author

vinayakankugoyal commented Jan 5, 2022 •
edited
Loading

/cc @justaugustus @saschagrunert because they last touched this file.

cpanato
cpanato reviewed Jan 6, 2022
View reviewed changes
dependencies.yaml Outdated Show resolved Hide resolved
@vinayakankugoyal vinayakankugoyal changed the title Use docker image instead of using curl to download and instal golangci-lint. Add checksum validation for the golangci-lint install script. Jan 6, 2022
@vinayakankugoyal
Copy link
Contributor Author

@cpanato please take another looks! Thanks!

@vinayakankugoyal
Copy link
Contributor Author

@cpanato - Please take another look. I am adding checksum for the installation script so that we can verify that it is what we intended to download.

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jan 12, 2022
@vinayakankugoyal
Copy link
Contributor Author

@cpanato - Could please take another look. I addressed all the comments. TIA!

cpanato
cpanato reviewed Jan 13, 2022
View reviewed changes
Copy link
Member

@cpanato cpanato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for working on this i'm fine which those changes.
maybe just split the lint fixes in another commit to make it more clear

/assign @puerco @saschagrunert for thoughts as well

@vinayakankugoyal
Copy link
Contributor Author

@puerco and @saschagrunert - Please take a look, thanks!

@vinayakankugoyal
Copy link
Contributor Author

@puerco and @saschagrunert - Please take a look, thanks!

Gentle ping!

@k8s-ci-robot k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 21, 2022
@vinayakankugoyal
Copy link
Contributor Author

@saschagrunert - please take a look. I noticed that you recently updated this file.

puerco
puerco requested changes Jan 27, 2022
View reviewed changes
Copy link
Member

@puerco puerco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR @vinayakankugoyal !
In the future, please try to scope your commits each for one change so that the PR is easier to review. The lint changes and the install script were mixed in one commit and it was difficult to understand at a glance.

Could you strip the lint warning changes (I think they are gone now), rebase and address the comments below?

hack/verify-golangci-lint.sh
URL_BASE=https://raw.githubusercontent.com/golangci/golangci-lint
URL=$URL_BASE/$VERSION/install.sh
INSTALL_CHECKSUM=294771225087ee48c8e0a45a99ac82ed8f9c6e9d384e692ab201986479c8594f
Copy link
Member

@puerco puerco Jan 27, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Expanding a little on @cpanato's comment, could you add a comment so that anyone bumping the golangci-lint version can know how to obtain the install script sha?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

hack/verify-golangci-lint.sh Outdated
$INSTALL_SCRIPT $VERSION
PATH=$PATH:bin
else
echo 'ERROR: failed to install golangci-lint' >&2
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's output here the actual reason of why the install failed:

Suggested change
echo 'ERROR: failed to install golangci-lint' >&2
echo 'ERROR: install script sha256 checksum invalid' >&2

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@saschagrunert
Copy link
Member

@vinayakankugoyal sorry for the late reply, can you please rebase this PR and address @puerco's comments?

@k8s-ci-robot k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 27, 2022
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jan 27, 2022
@saschagrunert
Copy link
Member

/test pull-release-integration-test

@vinayakankugoyal
Copy link
Contributor Author

@puerco - Thanks for taking a look. I address your comments and after rebase the lint changes were not needed because someone else already bumped the version to 1.43.0 and fixed all the linter callouts. PTAL. TIA!

saschagrunert
saschagrunert reviewed Jan 27, 2022
View reviewed changes
dependencies.yaml Outdated Show resolved Hide resolved
@vinayakankugoyal @saschagrunert
Update dependencies.yaml
a4f8f11 
Co-authored-by: Sascha Grunert <sgrunert@redhat.com>
@saschagrunert saschagrunert added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Jan 27, 2022
@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jan 27, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: saschagrunert, vinayakankugoyal

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 27, 2022
@k8s-ci-robot k8s-ci-robot merged commit f720664 into kubernetes:master Jan 27, 2022
@k8s-ci-robot k8s-ci-robot added this to the v1.24 milestone Jan 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cpanato cpanato cpanato left review comments

@puerco puerco puerco requested changes

@saschagrunert saschagrunert saschagrunert approved these changes

@onlydole onlydole Awaiting requested review from onlydole

@thejoycekung thejoycekung Awaiting requested review from thejoycekung

@justaugustus justaugustus Awaiting requested review from justaugustus

Assignees

@saschagrunert saschagrunert

@puerco puerco

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/release-eng Issues or PRs related to the Release Engineering subproject cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority release-note-none Denotes a PR that doesn't merit a release note. sig/release Categorizes an issue or PR as relevant to SIG Release. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges.
Projects
None yet
Milestone
v1.24
Development

Successfully merging this pull request may close these issues.
5 participants
@vinayakankugoyal @saschagrunert @k8s-ci-robot @puerco @cpanato