From: Dmitry Misharov Date: Thu, 27 Mar 2025 15:49:20 +0000 (+0100) Subject: pin GitHub Actions revisions from untrusted vendors X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ee9a519be803f2b1a7a8b82167c7a883a0483fc;p=thirdparty%2Fopenssl.git pin GitHub Actions revisions from untrusted vendors Reviewed-by: Neil Horman Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/27181) --- diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4eb1fd13d01..4c53ce8ab38 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -156,7 +156,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -165,21 +165,21 @@ jobs: sudo pkg install -y gcc perl5 ./config --strict-warnings enable-fips enable-lms enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -630,7 +630,7 @@ jobs: sudo apt-get update sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy gdb libtls-dev - name: install cpanm and Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d # v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -639,7 +639,7 @@ jobs: run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump - name: make run: make -s -j4 - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 - name: get cpu info run: | cat /proc/cpuinfo @@ -728,9 +728,9 @@ jobs: uses: actions/setup-python@v5.3.0 with: python-version: ${{ matrix.PYTHON }} - - uses: dtolnay/rust-toolchain@stable + - uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4 with: - toolchain: stable + toolchain: stable - name: get cpu info run: | cat /proc/cpuinfo diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml index 17e610573ce..41d5bfdfce5 100644 --- a/.github/workflows/coveralls.yml +++ b/.github/workflows/coveralls.yml @@ -93,7 +93,7 @@ jobs: sudo apt-get -yq install lcov sudo apt-get -yq install bison gettext keyutils ldap-utils libldap2-dev libkeyutils-dev python3 python3-paste python3-pyrad slapd tcsh python3-virtualenv virtualenv python3-kdcproxy - name: install Test2::V0 for gost_engine testing - uses: perl-actions/install-with-cpanm@stable + uses: perl-actions/install-with-cpanm@10d60f00b4073f484fc29d45bfbe2f776397ab3d #v1.7 with: install: Test2::V0 - name: setup hostname workaround @@ -119,7 +119,7 @@ jobs: --branch-coverage -o ./lcov.info - name: Coveralls upload - uses: coverallsapp/github-action@v2.3.2 + uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b #v2.3.6 with: github-token: ${{ secrets.github_token }} git-branch: ${{ matrix.branches.branch }} diff --git a/.github/workflows/os-zoo.yml b/.github/workflows/os-zoo.yml index c5f16631775..9b75a4dac46 100644 --- a/.github/workflows/os-zoo.yml +++ b/.github/workflows/os-zoo.yml @@ -133,7 +133,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: install nasm run: | choco install nasm @@ -150,7 +150,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -239,7 +239,7 @@ jobs: steps: - uses: actions/checkout@v4 - name: config - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" @@ -248,21 +248,21 @@ jobs: sudo pkg install -y gcc perl5 ./config --strict-warnings enable-fips enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-ssl3 enable-ssl3-method enable-trace - name: config dump - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: ./configdata.pm --dump - name: make - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" shutdown_vm: false run: make -j4 - name: make test - uses: cross-platform-actions/action@v0.26.0 + uses: cross-platform-actions/action@fe0167d8082ac584754ef3ffb567fded22642c7d #v0.27.0 with: operating_system: freebsd version: "13.4" diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml index 22f1fbf3c5f..38ae0a01917 100644 --- a/.github/workflows/windows.yml +++ b/.github/workflows/windows.yml @@ -32,7 +32,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 with: arch: ${{ matrix.platform.arch }} - name: install nasm @@ -50,7 +50,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -99,7 +99,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -111,7 +111,7 @@ jobs: working-directory: _build run: nmake /S - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -135,7 +135,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: prepare the build directory run: mkdir _build - name: config @@ -147,7 +147,7 @@ jobs: working-directory: _build run: nmake # verbose, so no /S here - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -182,7 +182,7 @@ jobs: steps: # Checkout before cygwin can mess with PATH... - uses: actions/checkout@v4 - - uses: cygwin/cygwin-install-action@master + - uses: cygwin/cygwin-install-action@f61179d72284ceddc397ed07ddb444d82bf9e559 #v5 with: packages: perl git make gcc-core - name: Check repo diff --git a/.github/workflows/windows_comp.yml b/.github/workflows/windows_comp.yml index 5e4048a75d2..0cb3cee5c85 100644 --- a/.github/workflows/windows_comp.yml +++ b/.github/workflows/windows_comp.yml @@ -26,7 +26,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: install nasm run: | choco install nasm @@ -62,7 +62,7 @@ jobs: reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/ @@ -88,7 +88,7 @@ jobs: - uses: actions/checkout@v4 - name: checkout fuzz/corpora submodule run: git submodule update --init --depth 1 fuzz/corpora - - uses: ilammy/msvc-dev-cmd@v1 + - uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 #v1.13.0 - name: install nasm run: | choco install nasm @@ -124,7 +124,7 @@ jobs: reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32 reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32 - name: download coreinfo - uses: suisei-cn/actions-download-file@v1.6.0 + uses: suisei-cn/actions-download-file@818d6b7dc8fe73f2f924b6241f2b1134ca1377d9 #v1.6.0 with: url: "https://download.sysinternals.com/files/Coreinfo.zip" target: _build/coreinfo/