Harden (#40)

* Checksum validation

Signed-off-by: Chris Wayne <cwayne18@gmail.com>

Author: cwayne18

Makefile

@@ -2,8 +2,18 @@ TARGETS := $(shell ls scripts)
 
 .dapper:
 	@echo Downloading dapper
-	@curl -sL https://releases.rancher.com/dapper/latest/dapper-$$(uname -s)-$$(uname -m) > .dapper.tmp
-	@@chmod +x .dapper.tmp
+	@DAPPER_BINARY="dapper-$$(uname -s)-$$(uname -m)"; \
+	case "$$DAPPER_BINARY" in \
+		dapper-Linux-x86_64)  DAPPER_SHA256="ff6105ec0a2a973d972810a2dbdb9a6bae65031d286eae082d6779e04e4c2255" ;; \
+		dapper-Linux-aarch64) DAPPER_SHA256="cbc133224cca7593482855d8dcdec247288ec83f0fc99fbbe0ad8423260930ff" ;; \
+		dapper-Linux-arm)     DAPPER_SHA256="5455fb8663fddc41f32feb426aa85599d7595a87ffed5144e89e1ecc88a3586b" ;; \
+		dapper-Darwin-x86_64) DAPPER_SHA256="850e5f867d9d04840b64b159a8a74dcb56f964185c4bd6631941df738cbc98b4" ;; \
+		dapper-Darwin-arm64)  DAPPER_SHA256="ca0a5c32341e6474f9140433110153e0eef304ef74d0a830194428b103e7b52e" ;; \
+		*) echo "No pinned SHA256 for dapper on platform: $$DAPPER_BINARY" >&2; exit 1 ;; \
+	esac; \
+	curl -fsSL "https://releases.rancher.com/dapper/latest/$$DAPPER_BINARY" > .dapper.tmp; \
+	echo "$$DAPPER_SHA256  .dapper.tmp" | sha256sum -c -
+	@chmod +x .dapper.tmp
 	@./.dapper.tmp -v
 	@mv .dapper.tmp .dapper
 

scripts/download

@@ -25,12 +25,16 @@ if [[ -z "${LOCAL_ARTIFACTS}" ]]; then
     else
         SUFFIX="-${ARCH}"
     fi
-
+    pushd artifacts
     if [ -n "${PRIME_RIBS}" ]; then
-        curl -sfL -R -o artifacts/k3s https://${PRIME_RIBS}/k3s/${URI_VERSION}/k3s${SUFFIX}
+        curl -sfL -R -o "k3s${SUFFIX}" https://${PRIME_RIBS}/k3s/${URI_VERSION}/k3s${SUFFIX}
+        curl -sfL -R -o sha256sum-${ARCH}.txt https://${PRIME_RIBS}/k3s/${URI_VERSION}/sha256sum-${ARCH}.txt
     else
-        curl -sfL -R -o artifacts/k3s https://github.com/k3s-io/k3s/releases/download/${URI_VERSION}/k3s${SUFFIX}
+        curl -sfL -R -o "k3s${SUFFIX}" https://github.com/k3s-io/k3s/releases/download/${URI_VERSION}/k3s${SUFFIX}
+        curl -sfL -R -o sha256sum-${ARCH}.txt https://github.com/k3s-io/k3s/releases/download/${URI_VERSION}/sha256sum-${ARCH}.txt
     fi
+    grep -E "^[0-9a-f]+  k3s${SUFFIX}$" sha256sum-${ARCH}.txt | sha256sum -c -
+    popd
 else
     cp local/* artifacts
     chmod +x artifacts/installer.sh

scripts/version

@@ -9,7 +9,7 @@ if [ -z "$OS" ]; then
     OS="linux"
 fi
 
-FALLBACK_VERSION=v1.21.13+k3s1
+FALLBACK_VERSION=v1.35.2+k3s1
 
 # This version script expects either a tag of format: <k3s-version> or no tag at all.