romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 14:57:17 +03:00
Code Issues Projects Releases Packages Wiki Activity

GHA: verify tarball downloads

Browse source 
Detect latest tarball version via the https://curl.se/downloads.html
page, download the signing key from a public keyserver then verify
source download signatures.

To ensure that public downloads are intact.

Closes #21759
This commit is contained in:
Viktor Szakats 2026-05-26 15:56:27 +02:00
parent 500820682c
commit 2cc171cbd4
No known key found for this signature in database
1 changed files with 38 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

38
.github/workflows/distcheck.yml vendored
View file

@ -367,3 +367,41 @@ jobs:
export TEST_CMAKE_FLAGS='-DCMAKE_C_COMPILER=x86_64-w64-mingw32-gcc -DOPENSSL_ROOT_DIR=C:/msys64/mingw64'
fi
./tests/cmake/test.sh find_package ${TESTOPTS} -DCURL_USE_OPENSSL=ON
verify-tarball-downloads:
name: 'Verify tarball downloads'
runs-on: ubuntu-slim
timeout-minutes: 2
steps:
- name: 'download and import GPG key'
env:
CURL_GPG_ID: 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2
run: |
for keyserver in \
https://keyserver.ubuntu.com/ \
https://pgpkeys.eu/ \
; do
echo "--- Downloading from ${keyserver}..."
if curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
"${keyserver}pks/lookup?op=get&options=mr&exact=on&search=0x${CURL_GPG_ID}" \
| gpg --batch --keyserver-options timeout=15 --display-charset utf-8 --keyid-format 0xlong --import --status-fd 1 2>&1; then
break
fi
done
- name: 'download and verify tarballs'
run: |
echo "--- Detecting latest curl tarball version..."
curl_version="$(curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused https://curl.se/download.html \
| grep -o -E 'curl [0-9]+\.[0-9]+\.[0-9]+' | cut -c 6-)"
for suffix in .tar.bz2 .tar.gz .tar.xz .zip; do
echo "--- Downloading ${curl_version} ${suffix}..."
curl --disable --fail --silent --show-error --connect-timeout 15 --max-time 60 --retry 3 --retry-connrefused \
--output pkg.bin "https://curl.se/download/curl-${curl_version}${suffix}" \
--output pkg.sig "https://curl.se/download/curl-${curl_version}${suffix}.asc"
echo "--- Verifying ${curl_version} ${suffix}..."
gpg --batch --keyserver-options timeout=15 --display-charset utf-8 --keyid-format 0xlong --verify-options show-primary-uid-only \
--verify pkg.sig pkg.bin 2>&1
echo '---'
done