Skip to content

Commit 8ecac04

Browse files
juenglinjuenglin
committed
CI: invalidate pre-verification CTK cache; update CA certs in test container
Two follow-ups from CodeRabbit review of the eMudhra hardening backport: - fetch_ctk: add 'verified' prefix to CTK_CACHE_KEY / CTK_CACHE_FILENAME so that cache entries written before the hash-verification logic was introduced cannot hit and bypass the new verify-metadata / archive SHA-256 checks. - test-wheel-linux: upgrade ca-certificates inside the ubuntu:22.04 test container before its first HTTPS operation. The host-level upgrade-ca-certificates action does not affect the container, so the container's trust store could otherwise still accept the compromised eMudhra/emSign intermediates.
1 parent 38fc040 commit 8ecac04

2 files changed

Lines changed: 12 additions & 2 deletions

File tree

‎.github/actions/fetch_ctk/action.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,11 @@ runs:
3838
--metadata-url "$CTK_JSON_URL")"
3939
4040
HASH=$(echo -n "${CTK_CACHE_COMPONENTS}" | sha256sum | awk '{print $1}')
41-
echo "CTK_CACHE_KEY=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH" >> $GITHUB_ENV
42-
echo "CTK_CACHE_FILENAME=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH.tar.gz" >> $GITHUB_ENV
41+
# "verified" prefix ensures cached entries from before hash-verification
42+
# was introduced never match; bump this prefix when the verification
43+
# logic changes in a way that old caches should not satisfy.
44+
echo "CTK_CACHE_KEY=mini-ctk-verified-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH" >> $GITHUB_ENV
45+
echo "CTK_CACHE_FILENAME=mini-ctk-verified-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH.tar.gz" >> $GITHUB_ENV
4346
echo "CTK_CACHE_COMPONENTS=${CTK_CACHE_COMPONENTS}" >> $GITHUB_ENV
4447
4548
- name: Install dependencies

‎.github/workflows/test-wheel-linux.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,13 @@ jobs:
143143
dependencies: "jq wget libgl1 libegl1 g++ util-linux"
144144
dependent_exes: "jq wget"
145145

146+
- name: Update CA certificates in the test container
147+
# The host-level upgrade-ca-certificates action does not affect this
148+
# container. Upgrade ca-certificates before the first HTTPS operation
149+
# so the container distrusts the compromised eMudhra/emSign intermediates.
150+
run: |
151+
apt-get install --only-upgrade -y ca-certificates
152+
146153
- name: Checkout driver install scripts (workflow revision)
147154
if: ${{ matrix.DRIVER != 'latest' && matrix.DRIVER != 'earliest' }}
148155
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

0 commit comments

Comments
 (0)