fix(scanner): keep G09 source binary path clean (#7532)

Keep checksum verification output out of the command substitution that resolves the previous-release binary for the G09 runner.

Also tolerate non-GNU sha256sum in local self-tests by falling back to shasum when GNU --check support is unavailable.

Co-authored-by: zhi22915 <qiuzgang@gmail.com>
This commit is contained in:
houseme
2026-09-09 00:21:39 +08:00
committed by GitHub
parent d288496752
commit b5d33a1f4e
@@ -178,7 +178,7 @@ ensure_default_asset_platform() {
verify_sha256() {
local archive="$1"
if command -v sha256sum >/dev/null 2>&1; then
if command -v sha256sum >/dev/null 2>&1 && [[ "$(sha256sum --help 2>&1)" == *"--check"* ]]; then
printf '%s %s\n' "$SOURCE_SHA256" "$archive" | sha256sum --check --strict
elif command -v shasum >/dev/null 2>&1; then
printf '%s %s\n' "$SOURCE_SHA256" "$archive" | shasum -a 256 --check
@@ -242,7 +242,7 @@ resolve_source_binary() {
local archive="$SOURCE_DIR/$SOURCE_ASSET"
curl --fail --location --retry 3 --output "$archive" \
"https://github.com/$SOURCE_REPOSITORY/releases/download/$SOURCE_VERSION/$SOURCE_ASSET"
verify_sha256 "$archive"
verify_sha256 "$archive" >&2
unzip -q "$archive" -d "$SOURCE_DIR"
chmod +x "$binary"
test -x "$binary"
@@ -432,6 +432,18 @@ run_self_test() {
fi
mkdir -p "$tmp/run/mixed-version-upgrade" "$tmp/run/bucket-config-rollback"
mkdir -p "$tmp/source"
local archive checksum checksum_output
archive="$tmp/source/$SOURCE_ASSET"
printf 'not a real archive\n' >"$archive"
if command -v shasum >/dev/null 2>&1; then
checksum="$(shasum -a 256 "$archive" | awk '{print $1}')"
else
checksum="$(sha256sum "$archive" | awk '{print $1}')"
fi
checksum_output="$(SOURCE_SHA256="$checksum" verify_sha256 "$archive")"
[[ "$checksum_output" == *"OK"* ]]
local current previous
current="$(git rev-parse HEAD)"
previous="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"