From cee98c50fd82ff1afe2e33d436fcaa85a7513cf1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Cie=C5=9Blak?= Date: Mon, 3 Feb 2025 15:50:38 +0100 Subject: [PATCH] Update integrity keys used by corepack (#51761) * Add shasum for pnpm in packageManager field The shasum was generated by executing `corepack use pnpm@9.9.0`. * Make corepack use updated keys * Export keys where needed instead of saving to $GITHUB_ENV * Add COREPACK_INTEGRITY_KEYS to Dockerfiles and build.ps1 --- .github/workflows/build-macos.yaml | 1 + .github/workflows/lint-ui.yaml | 4 +++- .github/workflows/unit-tests-ui.yaml | 4 +++- build.assets/Dockerfile | 1 + build.assets/Dockerfile-arm | 1 + build.assets/Dockerfile-node | 1 + build.assets/versions.mk | 2 ++ build.assets/windows/build.ps1 | 1 + package.json | 2 +- 9 files changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-macos.yaml b/.github/workflows/build-macos.yaml index e9dc86b241e..224b9b9bd79 100644 --- a/.github/workflows/build-macos.yaml +++ b/.github/workflows/build-macos.yaml @@ -40,6 +40,7 @@ jobs: echo RUST_VERSION=$(make -s -C build.assets print-rust-version) >> $GITHUB_ENV echo WASM_PACK_VERSION=$(make -s -C build.assets print-wasm-pack-version) >> $GITHUB_ENV echo PKG_CONFIG_PATH="$(build.assets/build-fido2-macos.sh pkg_config_path)" >> $GITHUB_ENV + echo COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' >> $GITHUB_ENV - name: Print versions run: | diff --git a/.github/workflows/lint-ui.yaml b/.github/workflows/lint-ui.yaml index 375ed5fd64a..0ecb61a6408 100644 --- a/.github/workflows/lint-ui.yaml +++ b/.github/workflows/lint-ui.yaml @@ -40,7 +40,9 @@ jobs: node --version - name: Install JS dependencies - run: pnpm install --frozen-lockfile + run: | + export COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' + pnpm install --frozen-lockfile - name: Build WASM run: pnpm build-wasm diff --git a/.github/workflows/unit-tests-ui.yaml b/.github/workflows/unit-tests-ui.yaml index 3c4e39097ac..65c39eabc8a 100644 --- a/.github/workflows/unit-tests-ui.yaml +++ b/.github/workflows/unit-tests-ui.yaml @@ -47,7 +47,9 @@ jobs: node --version - name: Install JS dependencies - run: pnpm install --frozen-lockfile + run: | + export COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' + pnpm install --frozen-lockfile - name: Build WASM run: pnpm build-wasm diff --git a/build.assets/Dockerfile b/build.assets/Dockerfile index 133e4106cd0..d306d0ee857 100644 --- a/build.assets/Dockerfile +++ b/build.assets/Dockerfile @@ -245,6 +245,7 @@ RUN export NODE_ARCH=$(if [ "$BUILDARCH" = "amd64" ]; then echo "x64"; else echo mkdir -p ${NODE_PATH} && \ curl -o /tmp/nodejs.tar.xz -fsSL ${NODE_URL} && \ tar -xJf /tmp/nodejs.tar.xz -C /usr/local/lib/nodejs-linux --strip-components=1 +ENV COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' RUN corepack enable yarn pnpm # Install Go. diff --git a/build.assets/Dockerfile-arm b/build.assets/Dockerfile-arm index b3f63f1eb3f..eb0bf52de3e 100644 --- a/build.assets/Dockerfile-arm +++ b/build.assets/Dockerfile-arm @@ -57,6 +57,7 @@ RUN NODE_ARCH="$(if [ "$BUILDARCH" = 'amd64' ]; then echo 'x64'; else echo 'arm6 curl -o "$NODE_FILE" -fsSL "$NODE_URL" && \ tar -xJf "$NODE_FILE" -C /usr/local/lib/nodejs-linux --strip-components=1 && \ rm -f "$NODE_FILE" +ENV COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' RUN corepack enable pnpm # Install Go. diff --git a/build.assets/Dockerfile-node b/build.assets/Dockerfile-node index 59a3100c80e..e4929ac2b37 100644 --- a/build.assets/Dockerfile-node +++ b/build.assets/Dockerfile-node @@ -21,6 +21,7 @@ FROM node:${NODE_VERSION}-bullseye AS buildbox # https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope ARG BUILDARCH +ENV COREPACK_INTEGRITY_KEYS='{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' RUN corepack enable pnpm COPY locale.gen /etc/locale.gen diff --git a/build.assets/versions.mk b/build.assets/versions.mk index 5fdbc0fce8e..500691e530b 100644 --- a/build.assets/versions.mk +++ b/build.assets/versions.mk @@ -6,6 +6,8 @@ GOLANG_VERSION ?= go1.23.5 GOLANGCI_LINT_VERSION ?= v1.63.4 +# TODO(ravicious): When attempting to update Node.js version, see if corepack distributed with this +# version is > 0.31.0. If so, remove definitions of COREPACK_INTEGRITY_KEYS from CI. NODE_VERSION ?= 20.18.0 # Run lint-rust check locally before merging code after you bump this. diff --git a/build.assets/windows/build.ps1 b/build.assets/windows/build.ps1 index 2053ea9d960..b385380a0ad 100644 --- a/build.assets/windows/build.ps1 +++ b/build.assets/windows/build.ps1 @@ -144,6 +144,7 @@ function Install-Node { Expand-Archive -Path $NodeZipfile -DestinationPath $ToolchainDir Rename-Item -Path "$ToolchainDir/node-v$NodeVersion-win-x64" -NewName "$ToolchainDir/node" Enable-Node -ToolchainDir $ToolchainDir + $Env:COREPACK_INTEGRITY_KEYS = '{"npm":[{"expires":"2025-01-29T00:00:00.000Z","keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="},{"expires":null,"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g=="}]}' corepack enable pnpm Write-Host "::endgroup::" } diff --git a/package.json b/package.json index 01db8b2844f..f03978221ac 100644 --- a/package.json +++ b/package.json @@ -104,5 +104,5 @@ "web/.storybook/public" ] }, - "packageManager": "pnpm@9.9.0" + "packageManager": "pnpm@9.9.0+sha512.60c18acd138bff695d339be6ad13f7e936eea6745660d4cc4a776d5247c540d0edee1a563695c183a66eb917ef88f2b4feb1fc25f32a7adcadc7aaf3438e99c1" }