install.sh downloads git-cliff without verifying the shipped .sha512 / .sig #87
Description
install.sh fetches the release tarball and installs the binary with no integrity check:
curl --silent --show-error --fail --location --output "$TARGET" "$LOCATION"
${ARCHIVE_CMD} "$TARGET"
mv git-cliff-${TAG_NAME:1}/${GIT_CLIFF_BIN} "./bin/$GIT_CLIFF_BIN"
git-cliff releases already publish, next to each Linux and macOS tarball, a
<asset>.sha512 (shasum -a 512) and a GPG detached <asset>.sig. The action
could download the .sha512 alongside the tarball and run
shasum -a 512 -c before extracting, and optionally gpg --verify against a
pinned release key for authenticity. Windows zips currently ship neither, so
that path would need the checksum added on the git-cliff side first.
Context: apache/infrastructure-actions reviews every action version before
ASF projects may use it (apache/infrastructure-actions#1311 is the current
bump). An unverified binary download is one of the checks we flag, so a
verification step would help downstream consumers.
Happy to send a PR if you are open to it.
Drafted-by: Claude Fable 5.1; reviewed by @potiuk before posting
Activity
potiuk commentedon Oct 6, 2026
Friendly ping on this one - it is still blocking the
git-cliff-actionbump in apache/infrastructure-actions#1311. The.sha512/.sigassets are already published with each release, so verifying them ininstall.shshould be a small change. Happy to open a PR if you'd accept one.Drafted-by: Claude Code (Opus 5.5); reviewed by @potiuk before posting
verify-action-build: catch variable-URL downloads, dual-license repos
verify-action-build: catch variable-URL downloads, dual-license repos (…
orhun commentedon Oct 31, 2026
Hey, please send a PR!
This makes a lot of sense!
potiuk commentedon Oct 31, 2026
Fix in #88