🤖 Generated by the Agentic Engineer
Evidence
ci.yaml's ⚙️ Setup KSail step downloads the KSail release archive from a version-pinned URL, then extracts it and sudo installs it — with no integrity check:
curl -fsSL "https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/ksail_${KSAIL_VERSION}_linux_amd64.tar.gz" -o /tmp/ksail.tar.gz
tar -xzf /tmp/ksail.tar.gz -C /tmp
sudo install /tmp/ksail /usr/local/bin/ksail
A version-pinned URL is not an integrity check: it names which asset to fetch, not what bytes to expect. A replaced release asset would be installed and executed by the workflow.
Raised by CodeRabbit against the identical step newly added in #2830, where it has been fixed. This issue covers the pre-existing instance in ci.yaml, deliberately left out of that PR so a supply-chain change does not ride along inside a PR about Kubescape SARIF publishing.
Affected audience and impact
Every pull_request and merge_group run of ci.yaml that hits the validate job. merge_group runs gate merges to main, so the binary runs on a trusted path.
Expected behaviour
The archive is verified before it is extracted or installed, and a verification that cannot be performed fails the step rather than being skipped.
Acceptance criteria
- The validate job verifies ksail_${KSAIL_VERSION}_linux_amd64.tar.gz against the release's published ksail_${KSAIL_VERSION}_checksums.txt before tar -xzf.
- A missing checksum entry fails the step with an actionable message — it must not silently skip verification. Note grep exits 1 under set -euo pipefail, so the lookup needs || true or the step dies before the message prints.
- A checksum mismatch fails the step and names the expected and actual digests.
- Verified three ways before merge: real archive passes, a tampered archive fails, a missing entry fails closed.
The implementation in #2830's validate-main.yaml kubescape-baseline job is a working reference — this is the same block.
Deliberately NOT a pinned literal SHA
KSAIL_VERSION is Renovate-managed (datasource=github-releases, group ksail). Renovate bumps the version but cannot update an opaque digest beside it, so a pinned SHA breaks CI on every bump until hand-edited — a control that reliably breaks the routine path is one that gets removed.
Stated limit: archive and checksum list share an origin, so this detects a corrupted, truncated or individually-substituted asset, not a fully compromised release.
Stronger follow-up (measured, not speculative)
KSail publishes an attestation for the exact asset digest, but it is an https://in-toto.io/attestation/release/v0.2 predicate and gh attestation verify returns no attestations found for it — with the default predicate and with that one passed explicitly. So attestation-based verification is not a drop-in today; it needs its own investigation.
Size
Small — one run: block, plus the three-way verification.
Evidence
ci.yaml's ⚙️ Setup KSail step downloads the KSail release archive from a version-pinned URL, then extracts it and sudo installs it — with no integrity check:
curl -fsSL "https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/ksail_${KSAIL_VERSION}_linux_amd64.tar.gz" -o /tmp/ksail.tar.gz tar -xzf /tmp/ksail.tar.gz -C /tmp sudo install /tmp/ksail /usr/local/bin/ksailA version-pinned URL is not an integrity check: it names which asset to fetch, not what bytes to expect. A replaced release asset would be installed and executed by the workflow.
Raised by CodeRabbit against the identical step newly added in #2830, where it has been fixed. This issue covers the pre-existing instance in ci.yaml, deliberately left out of that PR so a supply-chain change does not ride along inside a PR about Kubescape SARIF publishing.
Affected audience and impact
Every pull_request and merge_group run of ci.yaml that hits the validate job. merge_group runs gate merges to main, so the binary runs on a trusted path.
Expected behaviour
The archive is verified before it is extracted or installed, and a verification that cannot be performed fails the step rather than being skipped.
Acceptance criteria
The implementation in #2830's validate-main.yaml kubescape-baseline job is a working reference — this is the same block.
Deliberately NOT a pinned literal SHA
KSAIL_VERSION is Renovate-managed (datasource=github-releases, group ksail). Renovate bumps the version but cannot update an opaque digest beside it, so a pinned SHA breaks CI on every bump until hand-edited — a control that reliably breaks the routine path is one that gets removed.
Stated limit: archive and checksum list share an origin, so this detects a corrupted, truncated or individually-substituted asset, not a fully compromised release.
Stronger follow-up (measured, not speculative)
KSail publishes an attestation for the exact asset digest, but it is an https://in-toto.io/attestation/release/v0.2 predicate and gh attestation verify returns no attestations found for it — with the default predicate and with that one passed explicitly. So attestation-based verification is not a drop-in today; it needs its own investigation.
Size
Small — one run: block, plus the three-way verification.