gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-07-26 08:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): verify release downloads before use (#4294)

Browse Source
This commit is contained in:
Zhengchao An
2026-07-06 10:29:49 +08:00
committed by GitHub
parent e68a52ff59
commit bc8e546636
4 changed files with 114 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Dockerfile.glibc
+13 -7
View File
@@ -20,6 +20,7 @@ ARG RELEASE=latest
RUN apt-get update && apt-get install -y --no-install-recommends \
ca-certificates \
curl \
jq \
unzip \
&& rm -rf /var/lib/apt/lists/*
@@ -32,9 +33,8 @@ RUN set -eux; \
*) echo "Unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
esac; \
if [ "$RELEASE" = "latest" ]; then \
TAG="$(curl -fsSL https://api.github.com/repos/rustfs/rustfs/releases \
| grep -o '"tag_name": "[^"]*"' | cut -d'"' -f4 | head -n 1)"; \
RELEASE_JSON="$(curl -fsSL "https://api.github.com/repos/rustfs/rustfs/releases/tags/$TAG")"; \
RELEASE_JSON="$(curl -fsSL https://api.github.com/repos/rustfs/rustfs/releases | jq -c '.[0]')"; \
TAG="$(printf '%s' "$RELEASE_JSON" | jq -r '.tag_name // empty')"; \
else \
TAG="$RELEASE"; \
RELEASE_JSON="$(curl -fsSL "https://api.github.com/repos/rustfs/rustfs/releases/tags/$TAG" 2>/dev/null || true)"; \
@@ -49,14 +49,20 @@ RUN set -eux; \
TAG="$ALT_TAG"; \
fi; \
fi; \
if [ -z "$TAG" ] || [ -z "$RELEASE_JSON" ]; then echo "Failed to resolve release metadata" >&2; exit 1; fi; \
echo "Using tag: $TAG (arch pattern: $ARCH_SUBSTR)"; \
URL="$(curl -fsSL "https://api.github.com/repos/rustfs/rustfs/releases/tags/$TAG" \
| grep -o "\"browser_download_url\": \"[^\"]*${ARCH_SUBSTR}[^\"]*\\.zip\"" \
| cut -d'"' -f4 | head -n 1)"; \
ASSET_JSON="$(printf '%s' "$RELEASE_JSON" | jq -c --arg arch "$ARCH_SUBSTR" '.assets[] | select((.name | contains($arch)) and (.name | endswith(".zip"))) | {name: .name, url: .browser_download_url, digest: .digest}' | head -n 1)"; \
if [ -z "$ASSET_JSON" ]; then echo "Failed to locate release asset for $ARCH_SUBSTR at tag $TAG" >&2; exit 1; fi; \
ASSET_NAME="$(printf '%s' "$ASSET_JSON" | jq -r '.name // empty')"; \
URL="$(printf '%s' "$ASSET_JSON" | jq -r '.url // empty')"; \
DIGEST="$(printf '%s' "$ASSET_JSON" | jq -r '.digest // empty')"; \
SHA256="$(printf '%s' "$DIGEST" | sed 's/^sha256://')"; \
\
if [ -z "$URL" ]; then echo "Failed to locate release asset for $ARCH_SUBSTR at tag $TAG" >&2; exit 1; fi; \
if [ -z "$URL" ] || [ -z "$ASSET_NAME" ]; then echo "Failed to locate release asset for $ARCH_SUBSTR at tag $TAG" >&2; exit 1; fi; \
if [ -z "$SHA256" ] || [ "$SHA256" = "$DIGEST" ]; then echo "Release asset $ASSET_NAME is missing a sha256 digest" >&2; exit 1; fi; \
\
curl -fL "$URL" -o rustfs.zip; \
printf '%s rustfs.zip\n' "$SHA256" | sha256sum -c -; \
unzip -q rustfs.zip -d /build; \
\
if [ ! -x /build/rustfs ]; then \