Harden CI downloads by adding checksum verification

[sozercan]

Motivation

• The GitHub Actions workflow downloaded and executed external tools and tarballs without integrity checks, creating a CI supply-chain risk.
• The change aims to ensure artifacts used during the Unit test job are verified before extraction or execution while preserving the existing installation behavior and versions.

Description

• Updated the Install kubebuilder step in .github/workflows/workflow.yaml to start with set -euo pipefail and to compute os and arch from go env for consistent filenames.
• Replaced simple curl -L -O invocations with curl --fail --show-error --silent --location --remote-name to fail loudly on network errors.
• Added checksum verification for kubebuilder_${os}_${arch} against checksums.txt, for Kubernetes server/client tarballs against their .sha256 files using sha256sum --check, and for the etcd tarball against SHA256SUMS.
• Kept the same extraction and installation steps (tar, chmod, move to /usr/local/kubebuilder/bin) and preserved the pinned KUBEBUILDER_VERSION, KUBERNETES_VERSION, and ETCD_VERSION values.

Testing

• Inspected the modified workflow contents with nl/sed to confirm the new Install kubebuilder block is present and well-formed, and this check succeeded.
• Searched the workflow with rg for sha256sum --check, checksums.txt, and SHA256SUMS to validate checksum checks were added, and this search succeeded.
• Attempted to parse the workflow YAML via a small python script that calls yaml.safe_load, but the environment lacks PyYAML so YAML parsing could not be executed.
• Attempted remote HTTP checks for upstream checksum files but received no responses in this environment, so end-to-end download verification could not be performed here.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e90e16a7e2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Re-indent heredoc body to keep workflow YAML valid

The heredoc payload is flush-left inside the run: | block, so YAML parsing treats $(cat kubernetes-server-...) as a new top-level key instead of script content. In my local check (ruby/Psych), this file fails to parse with could not find expected ':' at this line, which means GitHub Actions cannot load this workflow as written and the Unit test job will not run. The same indentation issue appears again in the second heredoc block.

Useful? React with 👍 / 👎.

[Copilot]

Pull request overview

This PR hardens the CI “Unit test” job by verifying checksums for externally downloaded build/test tooling (kubebuilder, Kubernetes tarballs, etcd) before extracting or executing them, reducing supply-chain risk in the GitHub Actions workflow.

Changes:

• Adds set -euo pipefail and normalizes os/arch from go env for consistent artifact naming.
• Replaces curl -L -O with stricter curl flags that fail on HTTP/network errors.
• Verifies downloaded artifacts using sha256sum --check against published checksum files before extraction.

Show a summary per file

File	Description
.github/workflows/workflow.yaml	Updates the kubebuilder/tools install step to enforce stricter shell behavior, hardened downloads, and checksum verification.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

.github/workflows/workflow.yaml:103

• kubectl is chmod'd at kubernetes/client/bin/kubectl, but later the workflow installs kubectl from kubernetes/server/bin/kubectl. This makes the chmod a no-op and could leave the installed kubectl without the expected executable bit. Use the same source path consistently for chmod + mv (client or server).

          chmod +x "kubebuilder_${os}_${arch}"
          chmod +x kubernetes/server/bin/kube-apiserver
          chmod +x kubernetes/client/bin/kubectl
          chmod +x "etcd-v${ETCD_VERSION}-${os}-${arch}/etcd"

• Files reviewed: 1/1 changed files
• Comments generated: 1

[Copilot]

The workflow downloads and verifies the Kubernetes client tarball, but the only subsequent reference is a chmod on kubernetes/client/bin/kubectl (the installed kubectl comes from the server tree). If the client tarball isn't needed, dropping its download/verify/extract will reduce CI time and surface area; otherwise, install kubectl from the client tarball consistently.

This issue also appears on line 99 of the same file.

Suggested change

	"https://dl.k8s.io/v${KUBERNETES_VERSION}/kubernetes-client-${os}-${arch}.tar.gz"
	curl --fail --show-error --silent --location --remote-name \
	"https://dl.k8s.io/v${KUBERNETES_VERSION}/kubernetes-client-${os}-${arch}.tar.gz.sha256"
	sha256sum --check --status <<EOF
	$(cat kubernetes-client-${os}-${arch}.tar.gz.sha256) kubernetes-client-${os}-${arch}.tar.gz
	EOF
	curl --fail --show-error --silent --location --remote-name \
	"https://github.com/etcd-io/etcd/releases/download/v${ETCD_VERSION}/etcd-v${ETCD_VERSION}-${os}-${arch}.tar.gz"
	curl --fail --show-error --silent --location --remote-name \
	"https://github.com/etcd-io/etcd/releases/download/v${ETCD_VERSION}/SHA256SUMS"
	grep " etcd-v${ETCD_VERSION}-${os}-${arch}.tar.gz$" SHA256SUMS | sha256sum --check --status
	tar -zxvf "kubernetes-server-${os}-${arch}.tar.gz"
	tar -zxvf "kubernetes-client-${os}-${arch}.tar.gz"
	tar -zxvf "etcd-v${ETCD_VERSION}-${os}-${arch}.tar.gz"
	chmod +x "kubebuilder_${os}_${arch}"
	chmod +x kubernetes/server/bin/kube-apiserver
	chmod +x kubernetes/client/bin/kubectl
	"https://github.com/etcd-io/etcd/releases/download/v${ETCD_VERSION}/etcd-v${ETCD_VERSION}-${os}-${arch}.tar.gz"
	curl --fail --show-error --silent --location --remote-name \
	"https://github.com/etcd-io/etcd/releases/download/v${ETCD_VERSION}/SHA256SUMS"
	grep " etcd-v${ETCD_VERSION}-${os}-${arch}.tar.gz$" SHA256SUMS | sha256sum --check --status
	tar -zxvf "kubernetes-server-${os}-${arch}.tar.gz"
	tar -zxvf "etcd-v${ETCD_VERSION}-${os}-${arch}.tar.gz"
	chmod +x "kubebuilder_${os}_${arch}"
	chmod +x kubernetes/server/bin/kube-apiserver

[JaydipGabani]

lgtm, with this we can just close without merging - #488