guettli/sharedinbox
1
0
Fork 0
Code Issues 21 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

security: verify Hugo binary checksum after download #162

New Issue
Closed
opened 2026-05-23 08:55:41 +00:00 by guettlibot · 0 comments
guettlibot commented 2026-05-23 08:55:41 +00:00 (Migrated from codeberg.org)
Copy Link
Copy Source

Problem

The website build container downloads Hugo at runtime with no integrity check (ci/main.go ~line 314):

```go
WithExec([]string{"curl", "-sL",
"https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_linux-amd64.tar.gz",
"-o", "/tmp/hugo.tar.gz"}).
```

If the release artifact at that URL is replaced (compromised GitHub release, CDN substitution, or network-level MITM), an arbitrary binary runs with access to the deploy SSH key. Hugo is used inside the container that then deploys to the production server via the SSH key.

The tag `v0.152.2` is not immutable — GitHub allows deleting and recreating releases/tags.

Fix

Add a SHA-256 check immediately after the download. The checksum is published by the Hugo project at the same release URL:

```
https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_checksums.txt
```

```go
// After the curl step:
WithExec([]string{"sh", "-c",
"echo 'EXPECTED_SHA256 /tmp/hugo.tar.gz' | sha256sum -c -"}).
```

Get the expected SHA-256 by running (on a trusted machine):
```
curl -sL https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_checksums.txt
| grep linux-amd64.tar.gz
```

Hardcode the hash in ci/main.go next to the download URL so they stay in sync during version bumps.

## Problem The website build container downloads Hugo at runtime with no integrity check (ci/main.go ~line 314): \`\`\`go WithExec([]string{"curl", "-sL", "https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_linux-amd64.tar.gz", "-o", "/tmp/hugo.tar.gz"}). \`\`\` If the release artifact at that URL is replaced (compromised GitHub release, CDN substitution, or network-level MITM), an arbitrary binary runs with access to the deploy SSH key. Hugo is used inside the container that then deploys to the production server via the SSH key. The tag \`v0.152.2\` is not immutable — GitHub allows deleting and recreating releases/tags. ## Fix Add a SHA-256 check immediately after the download. The checksum is published by the Hugo project at the same release URL: \`\`\` https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_checksums.txt \`\`\` \`\`\`go // After the curl step: WithExec([]string{"sh", "-c", "echo 'EXPECTED_SHA256 /tmp/hugo.tar.gz' | sha256sum -c -"}). \`\`\` Get the expected SHA-256 by running (on a trusted machine): \`\`\` curl -sL https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_checksums.txt \ | grep linux-amd64.tar.gz \`\`\` Hardcode the hash in ci/main.go next to the download URL so they stay in sync during version bumps.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
NeedSupervisor
Issue escalated to a human supervisor; agentloop will skip it until cleared.
 State/InProgress
State/Later
State/Planned
automerge
Eligible for automatic merge by CI
 ci-failure
Issue opened by agentloop to track a failing CI workflow; used for deduplication.
 do-not-merge
Plan PR — review only, do not merge.
 loop/code
Add to run the built-in "code" prompt; override at prompts/code.md.
 loop/code-ci-pending
Prompt "code" finished; waiting for the PR's CI to pass before advancing.
 loop/code-done
Prompt "code" finished successfully.
 loop/code-in-process
Agent for the "code" prompt is currently running on this issue.
 loop/merge
Managed by agentloop
 loop/merge-done
Managed by agentloop
 loop/merge-in-process
Managed by agentloop
 loop/plan
Add to run the built-in "plan" prompt; override at prompts/plan.md.
 loop/plan-done
Prompt "plan" finished successfully.
 loop/plan-in-process
Agent for the "plan" prompt is currently running on this issue.
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
guettlibot guettli
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: guettli/sharedinbox#162