Validate checksum of downloaded files

[richard-cox]

Jenkins Based

• https://github.com/rancher/dashboard/blob/master/cypress/jenkins/Dockerfile.ci#L6
• https://github.com/rancher/dashboard/blob/master/cypress/jenkins/Dockerfile.ci#L11
• https://github.com/rancher/dashboard/blob/master/cypress/jenkins/init.sh#L57
• https://github.com/rancher/dashboard/blob/master/cypress/jenkins/init.sh#L60
• https://github.com/rancher/dashboard/blob/master/cypress/jenkins/init.sh#L63

core dashboard based (#17083)

• https://github.com/rancher/dashboard/blob/master/.github/actions/install-chrome/action.yaml#L16
• https://github.com/rancher/dashboard/blob/master/.github/workflows/scripts/install-codecov.sh#L3
• Remove scripts/build-embedded EMBED_PKG usage
• https://github.com/rancher/dashboard/blob/master/scripts/e2e-k3s-start#L52
• https://github.com/rancher/dashboard/blob/master/scripts/e2e-k3s-start#L59

[richard-cox]

@izaac can you run through the jenkins usages of curl and update each to validate the checksum of the downloaded file matches a validated checksum?

I found gemini pretty good for for updating the scripts (see pr linked to other locations in description)

For more info see https://github.com/rancher/rancher-security/issues/1762 + https://github.com/rancher/security-team/wiki/how-to-act#31-insecure-usage-of-curl-and-wget

[izaac]

@richard-cox sure, will do. We're transitioning the orchestration to Ansible and deprecating corral moving the majority of the pipeline logic to a different repo. I will be taking care of what's going to stay in our dashboard repo

[richard-cox]

@izaac would you be able to update with an ETA?

[izaac]

All the Jenkins based checksum validations listed in the description were moved to a QA infra repository.

#17135
rancher/qa-infra-automation#84