search

adoptium / infrastructure

This repo contains all information about machine maintenance.
Apache License 2.0
85 stars 101 forks source link

windocker: Perform checksum verification on the cygwin + WinRM setup downloads #3715

Closed sxa closed 2 hours ago

sxa commented 4 weeks ago

The Windows 2022 dockerfile used for creating the build images is downloading and using two artifacts that do not have their checksums verified. This should be changed.

Noting also that the cygwin setup is not verified in the main windows playbook for cygwin either, so that should also be updated.

Also noting that we seem to have a copy of the cygwin setup tool in https://github.com/adoptium/infrastructure/tree/master/.github/cygwin-build although it's likely unused now since the Dockerfiles that utilised them have since been deleted.

sxa commented 3 weeks ago

I have verified that the "old" cygwin installer in the repo appears to still be functional therefore pulling the fixed version from git and copying into the image instead of downloading from the third-party repo would be feasible, if undesirable from a currency perspective. However I expect that there will be good PowerShell options for doing this.