Skip to content

Commit b00b54e

Browse files
juenglinjuenglin
committed
CI: invalidate pre-verification CTK cache; update CA certs in test container
Two follow-ups from CodeRabbit review of the eMudhra hardening backport: - fetch_ctk: add 'verified' prefix to CTK_CACHE_KEY / CTK_CACHE_FILENAME so that cache entries written before the hash-verification logic was introduced cannot hit and bypass the new verify-metadata / archive SHA-256 checks. - test-wheel-linux: upgrade ca-certificates inside the ubuntu:22.04 test container before its first HTTPS operation. The host-level upgrade-ca-certificates action does not affect the container, so the container's trust store could otherwise still accept the compromised eMudhra/emSign intermediates.
1 parent ec5617c commit b00b54e

2 files changed

Lines changed: 12 additions & 2 deletions

File tree

‎.github/actions/fetch_ctk/action.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,11 @@ runs:
4545
CTK_CACHE_COMPONENTS="${CTK_CACHE_COMPONENTS//,,/,}"
4646
4747
HASH=$(echo -n "${CTK_CACHE_COMPONENTS}" | sha256sum | awk '{print $1}')
48-
echo "CTK_CACHE_KEY=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH" >> $GITHUB_ENV
49-
echo "CTK_CACHE_FILENAME=mini-ctk-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH.tar.gz" >> $GITHUB_ENV
48+
# "verified" prefix ensures cached entries from before hash-verification
49+
# was introduced never match; bump this prefix when the verification
50+
# logic changes in a way that old caches should not satisfy.
51+
echo "CTK_CACHE_KEY=mini-ctk-verified-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH" >> $GITHUB_ENV
52+
echo "CTK_CACHE_FILENAME=mini-ctk-verified-${{ inputs.cuda-version }}-${{ inputs.host-platform }}-$HASH.tar.gz" >> $GITHUB_ENV
5053
echo "CTK_CACHE_COMPONENTS=${CTK_CACHE_COMPONENTS}" >> $GITHUB_ENV
5154
5255
- name: Install dependencies

‎.github/workflows/test-wheel-linux.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,13 @@ jobs:
108108
dependencies: "jq wget"
109109
dependent_exes: "jq wget"
110110

111+
- name: Update CA certificates in the test container
112+
# The host-level upgrade-ca-certificates action does not affect this
113+
# container. Upgrade ca-certificates before the first HTTPS operation
114+
# so the container distrusts the compromised eMudhra/emSign intermediates.
115+
run: |
116+
apt-get install --only-upgrade -y ca-certificates
117+
111118
- name: Set environment variables
112119
env:
113120
BUILD_CUDA_VER: ${{ inputs.build-ctk-ver }}

0 commit comments

Comments
 (0)