actions/setup-uv
2
0
Fork 0
mirror of https://github.com/astral-sh/setup-uv.git synced 2026-09-03 06:09:23 +00:00
Code Activity

Verify downloads with astral-sh/versions checksums (#1033)

Browse Source 
`setup-uv` currently ignores the `sha256` supplied by the default
`astral-sh/versions` manifest when a selected artifact is newer than its
bundled checksum table, allowing that download to proceed without
validation. Use the manifest checksum as a fallback after explicit and
bundled checksums, and reject manifest entries that do not provide one.
This preserves the stronger pinned hashes for known releases while
verifying newer releases without requiring an action update. Part of
#1032.

---------

Co-authored-by: Zanie Blue <contact@zanie.dev>
Co-authored-by: William Woodruff <william@yossarian.net>
Co-authored-by: Kevin Stillhammer <kevin.stillhammer@gmail.com>
This commit is contained in:
zaniebot
2026-09-01 17:07:32 +02:00
committed by GitHub
co-authored by Zanie Blue William Woodruff Kevin Stillhammer
parent 3aef7b92c5
commit cd13f92170
6 changed files with 96 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/setup/index.cjs
Generated Vendored
+20 -5
View File
@@ -99730,15 +99730,20 @@ var known_checksums_default = {
var KNOWN_CHECKSUMS = known_checksums_default;
// src/download/checksum/checksum.ts
async function validateChecksum(checksum, downloadPath, arch3, platform2, version3) {
async function validateChecksum(checksum, downloadPath, arch3, platform2, version3, manifestChecksum) {
const key = `${arch3}-${platform2}-${version3}`;
const hasProvidedChecksum = checksum !== void 0 && checksum !== "";
const checksumToUse = hasProvidedChecksum ? checksum : KNOWN_CHECKSUMS[key];
const knownChecksum = KNOWN_CHECKSUMS[key];
const hasManifestChecksum = manifestChecksum !== void 0 && manifestChecksum !== "";
const checksumToUse = hasProvidedChecksum ? checksum : knownChecksum ?? (hasManifestChecksum ? manifestChecksum : void 0);
if (checksumToUse === void 0) {
if (manifestChecksum !== void 0) {
throw new Error(`No checksum found for ${key} in manifest.`);
}
debug(`No checksum found for ${key}.`);
return;
}
const checksumSource = hasProvidedChecksum ? "provided checksum" : `KNOWN_CHECKSUMS entry for ${key}`;
const checksumSource = hasProvidedChecksum ? "provided checksum" : knownChecksum !== void 0 ? `KNOWN_CHECKSUMS entry for ${key}` : "manifest checksum";
debug(`Validating checksum using ${checksumSource}.`);
const isValid = await validateFileCheckSum(downloadPath, checksumToUse);
if (!isValid) {
@@ -101656,6 +101661,7 @@ async function downloadVersion(platform2, arch3, version3, checksum, githubToken
);
}
const resolvedChecksum = manifestUrl === void 0 ? checksum : resolveChecksum(checksum, artifact.checksum);
const manifestChecksum = artifact.checksum;
const mirrorUrl = downloadFromAstralMirror ? rewriteToMirror(artifact.downloadUrl) : void 0;
const downloadUrl = mirrorUrl ?? artifact.downloadUrl;
try {
@@ -101666,6 +101672,7 @@ async function downloadVersion(platform2, arch3, version3, checksum, githubToken
arch3,
version3,
resolvedChecksum,
manifestChecksum,
githubTokenForUrl(downloadUrl, githubToken)
);
} catch (err) {
@@ -101682,6 +101689,7 @@ async function downloadVersion(platform2, arch3, version3, checksum, githubToken
arch3,
version3,
resolvedChecksum,
manifestChecksum,
githubTokenForUrl(artifact.downloadUrl, githubToken)
);
}
@@ -101699,14 +101707,21 @@ function githubTokenForUrl(downloadUrl, githubToken) {
return void 0;
}
}
async function downloadArtifact(downloadUrl, artifactName, platform2, arch3, version3, checksum, githubToken) {
async function downloadArtifact(downloadUrl, artifactName, platform2, arch3, version3, checksum, manifestChecksum, githubToken) {
info2(`Downloading uv from "${downloadUrl}" ...`);
const downloadPath = await downloadTool(
downloadUrl,
void 0,
githubToken
);
await validateChecksum(checksum, downloadPath, arch3, platform2, version3);
await validateChecksum(
checksum,
downloadPath,
arch3,
platform2,
version3,
manifestChecksum
);
let uvDir;
if (platform2 === "pc-windows-msvc") {
try {