actions/runner-images
1
0
Fork 0
mirror of https://github.com/actions/runner-images.git synced 2025-12-20 06:35:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[windows] implement checksum validation for Powershell Core (#8247)

Browse Source
This commit is contained in:
ilia-shipitsin
2023-09-08 10:48:51 +02:00
committed by GitHub
parent 08f6a05904
commit acd00737c6
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
images/win/scripts/Installers/Install-PowershellCore.ps1
View File

@@ -1,10 +1,25 @@
################################################################################ ################################################################################
## File: Install-PowershellCore.ps1 ## File: Install-PowershellCore.ps1
## Desc: Install PowerShell Core ## Desc: Install PowerShell Core
## Supply chain security: checksum validation
################################################################################ ################################################################################
$ErrorActionPreference = "Stop" $ErrorActionPreference = "Stop"
#region functions
Function Get-PowerShellCoreHash
{
Param (
[Parameter(Mandatory = $True)]
[string] $Release
)
$hashURL = "https://github.com/PowerShell/PowerShell/releases/download/v${Release}/hashes.sha256"
(Invoke-RestMethod -Uri $hashURL).ToString().Split("`n").Where({ $_ -ilike "*PowerShell-${Release}-win-x64.msi*" }).Split(' ')[0]
}
#endregion
$tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName()) $tempDir = Join-Path ([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName())
$null = New-Item -ItemType Directory -Path $tempDir -Force -ErrorAction SilentlyContinue $null = New-Item -ItemType Directory -Path $tempDir -Force -ErrorAction SilentlyContinue
try { try {
@@ -21,6 +36,19 @@ try {
$packagePath = Join-Path -Path $tempDir -ChildPath $packageName $packagePath = Join-Path -Path $tempDir -ChildPath $packageName
Invoke-WebRequest -Uri $downloadURL -OutFile $packagePath Invoke-WebRequest -Uri $downloadURL -OutFile $packagePath
#region Supply chain security
Write-Verbose "Performing checksum verification"
$distributor_file_hash = Get-PowerShellCoreHash -Release $release
$local_file_hash = (Get-FileHash -Path $packagePath -Algorithm SHA256).Hash
if ($local_file_hash -ne $distributor_file_hash) {
Write-Host "hash must be equal to: ${distributor_file_hash}"
Write-Host "actual hash is: ${local_file_hash}"
throw 'Checksum verification failed, please rerun install'
}
#endregion
Write-Verbose "Performing quiet install" Write-Verbose "Performing quiet install"
$ArgumentList=@("/i", $packagePath, "/quiet") $ArgumentList=@("/i", $packagePath, "/quiet")
$process = Start-Process msiexec -ArgumentList $ArgumentList -Wait -PassThru $process = Start-Process msiexec -ArgumentList $ArgumentList -Wait -PassThru