Security hardening: pin the go install @latest tool fetches in CI and setup-dev.sh #267

New issue

Closed

opened 2026-07-19 03:33:14 +00:00 by hexajon · 0 comments

hexajon commented

2026-07-19 03:33:14 +00:00

(Migrated from codeberg.org)

CI installs its analysis tools from a moving @latest:

.forgejo/workflows/ci.yml:228 staticcheck, :292 govulncheck, :379 gosec
scripts/setup-dev.sh:221-225 gopls, staticcheck, govulncheck, gosec, goreleaser

A compromised upstream at @latest runs arbitrary code in CI (and on a contributor's dev machine). Blast radius in CI is limited - the container carries no secrets and the checkout is anonymous with no write token, so the worst case is a poisoned build result rather than credential theft - but it's a supply-chain hygiene gap. Note the same file already pins modernize@v0.22.0, so the pattern is inconsistent.

Fix: pin each tool to a specific released version (a tag is the minimum; a module version + go.sum-style trust is better where the installer supports it). Never a downgrade - pin to the current latest release of each.

Acceptance: no @latest in go install lines across CI workflows and setup-dev.sh; pinned versions are the current releases.

CI installs its analysis tools from a moving `@latest`: - `.forgejo/workflows/ci.yml:228` staticcheck, `:292` govulncheck, `:379` gosec - `scripts/setup-dev.sh:221-225` gopls, staticcheck, govulncheck, gosec, goreleaser A compromised upstream at `@latest` runs arbitrary code in CI (and on a contributor's dev machine). Blast radius in CI is limited - the container carries no secrets and the checkout is anonymous with no write token, so the worst case is a poisoned build result rather than credential theft - but it's a supply-chain hygiene gap. Note the same file already pins `modernize@v0.22.0`, so the pattern is inconsistent. Fix: pin each tool to a specific released version (a tag is the minimum; a module version + go.sum-style trust is better where the installer supports it). Never a downgrade - pin to the current latest release of each. Acceptance: no `@latest` in `go install` lines across CI workflows and `setup-dev.sh`; pinned versions are the current releases.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea#267

No description provided.

Rows
Columns