mirror of
https://github.com/anomalyco/hex.git
synced 2026-11-15 14:16:56 +08:00
Dax
f9ab7b5a9c
From the 2026-10-29 security review: - H1: Release signs each Linux executable with Anomaly's ed25519 key (HEX_RELEASE_SIGNING_KEY, .github/release/sign-linux.sh, which refuses a key that does not match linux-signing.pub) and publishes the signature as the linux-<arch>-sig target. The updater (updater/linux.rs SIGNING_KEY) and install-linux.sh refuse an executable without a valid signature over its SHA-256, before downloading it. Installed builds that predate this ignore the extra target, so the transition needs nothing from them. - H3: the installers move to the locked .github/release/ (CODEOWNERS @thdxr); the Installers workflow publishes them from a sparse checkout of that directory. - M1: the release service client is vendored as .github/release/release-client.sh instead of piping anoma.ly/release/client.sh into bash. - M2: check-windows.yml gets permissions: contents: read; every third-party action is pinned by SHA. - M3: resolve_url accepts only URLs on the manifest's host.
23 lines
627 B
Bash
Executable File
23 lines
627 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd)
|
|
installer="$root/.github/release/install-linux.sh"
|
|
|
|
if [ "${1:-install}" = uninstall ]; then
|
|
exec "$installer" uninstall
|
|
fi
|
|
if [ "${1:-install}" != install ]; then
|
|
echo "Usage: $0 [install|uninstall]" >&2
|
|
exit 1
|
|
fi
|
|
|
|
target_dir=${CARGO_TARGET_DIR:-"$root/target"}
|
|
cargo build --locked --release --manifest-path "$root/Cargo.toml"
|
|
version=$("$target_dir/release/hex" --version | awk 'NF { value=$NF } END { print value }')
|
|
|
|
HEX_INSTALL_SOURCE=1 \
|
|
HEX_INSTALL_ARTIFACT="$target_dir/release/hex" \
|
|
HEX_INSTALL_VERSION="$version" \
|
|
exec "$installer"
|