From: Dmitry Misharov Date: Mon, 31 Mar 2025 14:50:36 +0000 (+0200) Subject: pin GitHub Actions revisions from untrusted vendors X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=542fc2d23eafcf415a7b7ad940cffcac7092f651;p=thirdparty%2Fopenssl.git pin GitHub Actions revisions from untrusted vendors Reviewed-by: Neil Horman Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/27209) --- diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dcc258a7c1a..1bce06a7743 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -156,7 +156,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -165,21 +165,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -630,7 +630,7 @@ jobs: sudo apt-get update sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb - name: install cpanm and Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d # v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -639,7 +639,7 @@ jobs: run: ./config --banner=Configured --strict-warnings --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump - name: make run: make -s -j4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 - name: get cpu info run: | cat /proc/cpuinfo @@ -702,7 +702,7 @@ jobs: uses: actions/setup-python@v5.3.0 with: python-version: ${{ matrix.PYTHON }} - - uses: dtolnay/rust-toolchain@master + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: toolchain: ${{ matrix.RUST }} - name: get cpu info diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml index 3002787b764..05cec776031 100644 --- a/.github/workflows/coveralls.yml +++ b/.github/workflows/coveralls.yml @@ -93,7 +93,7 @@ jobs: sudo apt-get -yq install lcov sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d # v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -118,7 +118,7 @@ jobs: --ignore-errors mismatch -o ./lcov.info - name: Coveralls upload - uses: coverallsapp/github-action@v2.3.2 + uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b #v2.3.6 with: github-token: ${{ secrets.github_token }} git-branch: ${{ matrix.branches.branch }} diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml index 0a531cf5ae3..a5f945affae 100644 --- a/.github/workflows/os-zoo.yml +++ b/.github/workflows/os-zoo.yml @@ -133,11 +133,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -150,7 +150,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -227,21 +227,21 @@ jobs: sudo pkg install -y gcc perl5 ./config enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 03b1024f1c2..e3c022454ef 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 with: arch: ${{ matrix.platform.arch }} - name: install nasm @@ -50,7 +50,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -99,7 +99,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -111,7 +111,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -135,7 +135,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -147,7 +147,7 @@ jobs: working-directory: _build run: nmake # verbose, so no /S here - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -182,7 +182,7 @@ jobs: steps: # Checkout before cygwin can mess with PATH... - uses: actions/checkout@v4 - - uses: cygwin/cygwin-install-action@master + - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 #v5 with: packages: perl git make gcc-core - name: Check repo diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml index 5af3f7f4ef5..bd65e24a531 100644 --- a/.github/workflows/windows_comp.yml +++ b/.github/workflows/windows_comp.yml @@ -26,11 +26,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get zstd @@ -62,7 +62,7 @@ jobs: reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -88,11 +88,11 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 - name: install nasm run: | choco install nasm "C:\Program Files\NASM" | Out-File -FilePath "$env:GITHUB_PATH" -Append + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: Get brotli @@ -124,7 +124,7 @@ jobs: reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/