From: Dmitry Misharov Date: Mon, 31 Mar 2025 15:03:28 +0000 (+0200) Subject: pin GitHub Actions revisions from untrusted vendors X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06ce0b63dd671ac8aa2532063cd0a6d96ec0667a;p=thirdparty%2Fopenssl.git pin GitHub Actions revisions from untrusted vendors Reviewed-by: Neil Horman Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/27211) --- diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 04fac81f758..86dc3bd70af 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -156,7 +156,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -165,21 +165,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -630,7 +630,7 @@ jobs: sudo apt-get update sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb - name: install cpanm and Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d #v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -677,7 +677,7 @@ jobs: uses: actions/setup-python@v5.3.0 with: python-version: ${{ matrix.PYTHON }} - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: toolchain: ${{ matrix.RUST }} - name: get cpu info @@ -697,7 +697,7 @@ jobs: run: ./config --banner=Configured --strict-warnings enable-external-tests && perl configdata.pm --dump - name: make run: make -s -j4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 - name: get cpu info run: | cat /proc/cpuinfo diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml index 788a027b8dc..988a976c2d8 100644 --- a/.github/workflows/coveralls.yml +++ b/.github/workflows/coveralls.yml @@ -56,7 +56,7 @@ jobs: sudo apt-get -yq install lcov sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d #v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -82,7 +82,7 @@ jobs: --exclude "/usr/include/*" -o ./lcov.info - name: Coveralls upload - uses: coverallsapp/github-action@v2.3.2 + uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b #v2.3.6 with: github-token: ${{ secrets.github_token }} git-branch: ${{ matrix.branches.branch }} diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml index 28814d50e18..1ea6ccd61a7 100644 --- a/.github/workflows/os-zoo.yml +++ b/.github/workflows/os-zoo.yml @@ -141,11 +141,11 @@ jobs: ref: ${{ matrix.branch }} - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -158,7 +158,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -192,7 +192,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -201,21 +201,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 03b1024f1c2..e3c022454ef 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 with: arch: ${{ matrix.platform.arch }} - name: install nasm @@ -50,7 +50,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -99,7 +99,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -111,7 +111,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -135,7 +135,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -147,7 +147,7 @@ jobs: working-directory: _build run: nmake # verbose, so no /S here - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -182,7 +182,7 @@ jobs: steps: # Checkout before cygwin can mess with PATH... - uses: actions/checkout@v4 - - uses: cygwin/cygwin-install-action@master + - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 #v5 with: packages: perl git make gcc-core - name: Check repo diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml index 5af3f7f4ef5..bd65e24a531 100644 --- a/.github/workflows/windows_comp.yml +++ b/.github/workflows/windows_comp.yml @@ -26,11 +26,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get zstd @@ -62,7 +62,7 @@ jobs: reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -88,11 +88,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get brotli @@ -124,7 +124,7 @@ jobs: reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/