astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-08-10 00:03:29 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): match checksum manifest entries exactly in docker-release

Browse Source 
The substring grep for the archive line also captured the archive's
.sbom.json entry, whose file is deliberately not downloaded in this
lane, so the sha256sum check failed on every run. awk now matches the
manifest filename column exactly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Feng Ruohang
2026-08-06 22:21:17 +08:00
parent 86a7782900
commit b14ea22aa8
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/docker-release.yml
+5 -3
View File
@@ -102,10 +102,12 @@ jobs:
# The binaries going into the images are the published ones, checked # The binaries going into the images are the published ones, checked
# against the published checksums, not a rebuild that merely ought to # against the published checksums, not a rebuild that merely ought to
# match them. # match them. awk matches the manifest filename column exactly: a
# substring grep would also pull in the archive's .sbom.json line,
# whose file is deliberately not downloaded in this lane.
cd "${assets_dir}" cd "${assets_dir}"
grep -F " ${amd64_archive}" "${checksums}" | sha256sum --check awk -v name="${amd64_archive}" '$2 == name' "${checksums}" | sha256sum --check
grep -F " ${arm64_archive}" "${checksums}" | sha256sum --check awk -v name="${arm64_archive}" '$2 == name' "${checksums}" | sha256sum --check
# The checksum manifest and both archives must have provenance from # The checksum manifest and both archives must have provenance from
# this repository's release workflow at the exact checked-out tag. # this repository's release workflow at the exact checked-out tag.