From: Dmitry Misharov Date: Mon, 31 Mar 2025 15:24:48 +0000 (+0200) Subject: pin GitHub Actions revisions from untrusted vendors X-Git-Tag: openssl-3.2.6~88 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5cf2d618b0b9bc335a23e30398ccb12daade41a4;p=thirdparty%2Fopenssl.git pin GitHub Actions revisions from untrusted vendors Reviewed-by: Neil Horman Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/27213) --- diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fb43a758926..ffc03d847ef 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -129,7 +129,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -138,21 +138,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -501,7 +501,7 @@ jobs: sudo apt-get update sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install cpanm and Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d # v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -543,7 +543,7 @@ jobs: uses: actions/setup-python@v5.3.0 with: python-version: ${{ matrix.PYTHON }} - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: toolchain: ${{ matrix.RUST }} - name: get cpu info @@ -563,7 +563,7 @@ jobs: run: ./config --banner=Configured --strict-warnings enable-external-tests && perl configdata.pm --dump - name: make run: make -s -j4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 - name: get cpu info run: | cat /proc/cpuinfo diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml index 90d72dde741..7f8479ca880 100644 --- a/.github/workflows/coveralls.yml +++ b/.github/workflows/coveralls.yml @@ -50,7 +50,7 @@ jobs: sudo apt-get -yq install lcov sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d # v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -76,7 +76,7 @@ jobs: --exclude "/usr/include/*" -o ./lcov.info - name: Coveralls upload - uses: coverallsapp/github-action@v2.3.2 + uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b #v2.3.6 with: github-token: ${{ secrets.github_token }} git-branch: ${{ matrix.branches.branch }} diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml index c1650655303..8cf08d08f2c 100644 --- a/.github/workflows/os-zoo.yml +++ b/.github/workflows/os-zoo.yml @@ -146,7 +146,8 @@ jobs: run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append - - uses: shogo82148/actions-setup-perl@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 + - uses: shogo82148/actions-setup-perl@49c14f24551d2de3bf56fb107a869c3760b1875e #v1.33.0 - name: prepare the build directory run: mkdir _build - name: config @@ -159,7 +160,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -193,7 +194,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -202,21 +203,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 25c4b844a4e..9172234e980 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,14 +32,14 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 with: arch: ${{ matrix.platform.arch }} - name: install nasm run: | choco install nasm ${{ matrix.platform.arch == 'win32' && '--x86' || '' }} "C:\Program Files${{ matrix.platform.arch == 'win32' && ' (x86)' || '' }}\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append - - uses: shogo82148/actions-setup-perl@v1 + - uses: shogo82148/actions-setup-perl@49c14f24551d2de3bf56fb107a869c3760b1875e #v1.33.0 - name: prepare the build directory run: mkdir _build - name: config @@ -51,7 +51,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -82,8 +82,8 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - - uses: shogo82148/actions-setup-perl@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 + - uses: shogo82148/actions-setup-perl@49c14f24551d2de3bf56fb107a869c3760b1875e #v1.33.0 - name: prepare the build directory run: mkdir _build - name: config @@ -95,7 +95,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -119,8 +119,8 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - - uses: shogo82148/actions-setup-perl@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 + - uses: shogo82148/actions-setup-perl@49c14f24551d2de3bf56fb107a869c3760b1875e #v1.33.0 - name: prepare the build directory run: mkdir _build - name: config @@ -132,7 +132,7 @@ jobs: working-directory: _build run: nmake # verbose, so no /S here - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -167,7 +167,7 @@ jobs: steps: # Checkout before cygwin can mess with PATH... - uses: actions/checkout@v4 - - uses: cygwin/cygwin-install-action@master + - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 #v5 with: packages: perl git make gcc-core - name: Check repo diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml index b72137b12ff..9f74f4bbcdd 100644 --- a/.github/workflows/windows_comp.yml +++ b/.github/workflows/windows_comp.yml @@ -25,11 +25,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get zstd @@ -45,7 +45,7 @@ jobs: working-directory: _build run: nmake - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -67,11 +67,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get brotli @@ -87,7 +87,7 @@ jobs: working-directory: _build run: nmake - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/