ci(rust): check cargo-msrv's hash

eitsupi · eitsupi · commit 38e122351b94 · 2025-06-19T14:30:12.000Z
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
@@ -147,8 +147,17 @@ jobs:
         if: matrix.os == 'ubuntu-latest'
         working-directory: rust
         run: |
-          curl -L "https://github.com/foresterre/cargo-msrv/releases/download/v0.18.4/cargo-msrv-x86_64-unknown-linux-gnu-v0.18.4.tgz" |
-            tar xz --wildcards --strip-components=1 -C "$HOME/.local/bin" "*/cargo-msrv"
+          # Install cargo-msrv
+          cargo_msrv_version="v0.18.4"
+          cargo_msrv_hash="367a48e4ad014b119bf728a9e95e863575e02fdf6cf95ae24f44ca73b445ee14"
+          cargo_msrv_archive="cargo-msrv.tgz"
+
+          curl -L "https://github.com/foresterre/cargo-msrv/releases/download/${cargo_msrv_version}/cargo-msrv-x86_64-unknown-linux-gnu-${cargo_msrv_version}.tgz" -o "${cargo_msrv_archive}"
+          echo "${cargo_msrv_hash}  ${cargo_msrv_archive}" | sha256sum -c -
+          tar xz -f "${cargo_msrv_archive}" --wildcards --strip-components=1 -C "$HOME/.local/bin" "*/cargo-msrv"
+          rm "${cargo_msrv_archive}"
+
+          # Verify MSRV for each package
           find . -mindepth 2 -name Cargo.toml | while read -r dir
           do
             echo "Checking package '$dir'"
