From a9b642e151259e65514d74a543f6f0d0601549c2 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Tue, 28 Jul 2026 01:17:56 +0000 Subject: [PATCH] Fix insecure toolchain download in build.yml Remove the --no-check-certificate flag from wget when fetching the GNU ARM toolchain tarball in the GitHub Actions workflow. Disabling TLS certificate verification exposed the CI pipeline to potential machine-in-the-middle (MITM) attacks where an adversary could substitute a malicious toolchain. This change re-enables TLS certificate validation and adds cryptographic checksum pinning by verifying the SHA-256 hash (bcd840f839d5bf49279638e9f67890b2ef3a7c9c7a9b25271e83ec4ff41d177a) of gcc-arm.tar.bz2 prior to extraction. --- .github/workflows/build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e26a5618..f6fb9eea 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -47,7 +47,8 @@ jobs: cd /tmp sudo apt-get update sudo apt-get --no-install-recommends install -y ninja-build gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf - wget --tries 4 --no-check-certificate --quiet https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/RC2.1/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2 -O gcc-arm.tar.bz2 + wget --tries 4 --quiet https://developer.arm.com/-/media/Files/downloads/gnu-rm/9-2019q4/RC2.1/gcc-arm-none-eabi-9-2019-q4-major-x86_64-linux.tar.bz2 -O gcc-arm.tar.bz2 + echo "bcd840f839d5bf49279638e9f67890b2ef3a7c9c7a9b25271e83ec4ff41d177a gcc-arm.tar.bz2" | sha256sum -c tar xjf gcc-arm.tar.bz2 echo "PATH=/tmp/gcc-arm-none-eabi-9-2019-q4-major/bin:$PATH" >> "$GITHUB_ENV" - name: Checkout