Skip to content

fix(knife): GPG-verify Node.js SHASUMS256.txt.asc before committing checksums #2147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
loosebazooka merged 5 commits into from
Aug 31, 2026
Merged

fix(knife): GPG-verify Node.js SHASUMS256.txt.asc before committing checksums #2147

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
53d6b23
fix: verify Node.js SHASUMS256.txt.asc GPG signature before trusting …
rishuranjanofficial Aug 4, 2026
14401bb
gpg: verify Node.js checksums against committed release keys + daily …
rishuranjanofficial Aug 27, 2026
3a87c1a
gpg: verify inline-signed SHASUMS via --decrypt; drop unsigned plaint…
rishuranjanofficial Aug 28, 2026
f0b4e13
knife: expose update-node-keys subcommand; call it from the workflow
rishuranjanofficial Aug 28, 2026
b93dd0b
knife: use execFileSync with arg arrays for gpg calls (no shell expan…
rishuranjanofficial Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/workflows/update-node-keys.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: update-node-keys
on:
schedule:
- cron: "30 6 * * *"
workflow_dispatch:

permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false

- name: Update node release keys
run: ./knife.d/update_node_keys.sh

@loosebazooka loosebazooka Aug 28, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know our knife script structure is a bit silly. But update_node_keys.sh should be exposed directly in the knife script to be called like ./knife update-node-keys

@rishuranjanofficial rishuranjanofficial Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch - switched to gpg --output - --decrypt SHASUMS256.txt.asc, which verifies the inline signature and returns the authenticated checksums, and dropped the separate plaintext SHASUMS256.txt fetch so nothing unsigned is ever parsed. Validated against a real release (v22.11.0): good signature from a Node.js release signer + correct checksums, and confirmed it fails closed (non-zero exit) when the signer isn't in the committed keys. Pushed.

@rishuranjanofficial rishuranjanofficial Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

added an update-node-keys subcommand to knife (cmd_update_node_keys) and switched the workflow to run ./knife update-node-keys, matching the update-node-archives pattern. Pushed.


- name: Check for changes
run: |
if [[ $(git status --porcelain) ]]; then
echo "DISTROLESS_DIFF=true" >> "$GITHUB_ENV"
else
echo "No changes detected"; exit 0
fi

- name: Create commits
if: env.DISTROLESS_DIFF
env:
ACTIONS_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
run: |
git checkout -b update-node-keys
git config --global user.email "distroless-bot@google.com"
git config --global user.name "Distroless Bot"
git add knife.d/nodejs_keys.asc
git commit -s -m "Bumping Node.js release keys"
git remote set-url origin https://x-access-token:${ACTIONS_TOKEN}@github.com/${{ github.repository }}.git
git push --force origin HEAD

- name: Create Pull Request
if: env.DISTROLESS_DIFF
env:
GH_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
run: |
if ! OUTPUT=$(gh pr create -B main -H update-node-keys --fill 2>&1) ; then
echo "$OUTPUT"
[[ "$OUTPUT" =~ "already exists" ]] && exit 0 || exit 1
fi
Loading
Loading