ClinicianFOCUS / clinicianfocus-installer

Install tool to help with installing the software and tools under development in this applied research project.
GNU Affero General Public License v3.0
0 stars 1 forks source link

Add integrity verification for downloaded FreeScribe installer #14

Open yingbull opened 1 month ago

yingbull commented 1 month ago
          **🚨 suggestion (security):** Add integrity verification for downloaded FreeScribe installer

Consider adding a step to verify the integrity of the downloaded FreeScribe installer, such as checking a checksum or digital signature. This helps ensure that the downloaded file hasn't been tampered with or corrupted during transfer.

      - name: Download latest release EXE
        run: |
          curl -L -H "Accept: application/octet-stream" -o freescribe\FreeScribeInstaller_windows.exe ${{ steps.get_release.outputs.result }}
          echo "${{ secrets.INSTALLER_CHECKSUM }}  freescribe\FreeScribeInstaller_windows.exe" | sha256sum --check
      - name: Verify installer signature
        run: |
          signtool verify /pa freescribe\FreeScribeInstaller_windows.exe

_Originally posted by @sourcery-ai[bot] in https://github.com/ClinicianFOCUS/clinicianfocus-installer/pull/4#discussion_r1797211812_