ci: verify ksail release downloads

.github/actions/deploy-prod/action.yml

@@ -35,20 +35,17 @@ runs:
   using: composite
   steps:
     - name: ⚙️ Setup KSail
-      # Install the KSail CLI from the release tarball via curl. We use curl
-      # rather than brew/setup-ksail-cli because the v7.20.0 release shipped
-      # only desktop artifacts (linux CLI missing, 404 on the tarball).
-      # v7.25.0 ships complete linux artifacts again and carries the
-      # cluster-update fixes; renovate keeps this pin current.
+      # Install the KSail CLI from the release tarball and verify the
+      # downloaded asset against GitHub's release asset sha256 digest before
+      # running it with production credentials. We still use the tarball rather
+      # than brew/setup-ksail-cli because v7.20.0 shipped only desktop artifacts
+      # (linux CLI missing, 404 on the tarball); Renovate keeps this pin current.
       shell: bash
       env:
         # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
         KSAIL_VERSION: "7.175.2"
       run: |
-        curl -fsSL "https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/ksail_${KSAIL_VERSION}_linux_amd64.tar.gz" -o /tmp/ksail.tar.gz
-        tar -xzf /tmp/ksail.tar.gz -C /tmp
-        sudo install /tmp/ksail /usr/local/bin/ksail
-        ksail --version
+        .github/scripts/setup-ksail.sh
 
     - name: ⚙️ Setup talosctl
       # refresh-flux-ghcr-auth.sh uses the host API for a secret-safe,

.github/scripts/setup-ksail.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -z "${KSAIL_VERSION:-}" ]; then
+  echo "::error::KSAIL_VERSION must be set"
+  exit 1
+fi
+
+asset_name="ksail_${KSAIL_VERSION}_linux_amd64.tar.gz"
+release_url="https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/${asset_name}"
+api_url="https://api.github.com/repos/devantler-tech/ksail/releases/tags/v${KSAIL_VERSION}"
+tarball="${RUNNER_TEMP:-/tmp}/${asset_name}"
+release_json="${RUNNER_TEMP:-/tmp}/ksail-release-${KSAIL_VERSION}.json"
+
+curl_headers=(-H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28")
+if [ -n "${GITHUB_TOKEN:-}" ]; then
+  curl_headers+=(-H "Authorization: Bearer ${GITHUB_TOKEN}")
+fi
+
+curl -fsSL "${release_url}" -o "${tarball}"
+curl -fsSL "${curl_headers[@]}" "${api_url}" -o "${release_json}"
+
+expected_digest=$(python3 - "${release_json}" "${asset_name}" <<'PY'
+import json
+import sys
+
+release_path, asset_name = sys.argv[1:3]
+with open(release_path, encoding="utf-8") as release_file:
+    release = json.load(release_file)
+
+for asset in release.get("assets", []):
+    if asset.get("name") == asset_name:
+        digest = asset.get("digest", "")
+        if not digest.startswith("sha256:"):
+            print(f"asset {asset_name} has no sha256 digest in GitHub release metadata", file=sys.stderr)
+            sys.exit(1)
+        print(digest.removeprefix("sha256:"))
+        sys.exit(0)
+
+print(f"asset {asset_name} was not found in release metadata", file=sys.stderr)
+sys.exit(1)
+PY
+)
+
+printf '%s  %s\n' "${expected_digest}" "${tarball}" | sha256sum --check --status
+
+tar -xzf "${tarball}" -C "${RUNNER_TEMP:-/tmp}" ksail
+sudo install "${RUNNER_TEMP:-/tmp}/ksail" /usr/local/bin/ksail
+ksail --version

.github/workflows/ci.yaml

@@ -176,10 +176,7 @@ jobs:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
           KSAIL_VERSION: "7.175.2"
         run: |
-          curl -fsSL "https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/ksail_${KSAIL_VERSION}_linux_amd64.tar.gz" -o /tmp/ksail.tar.gz
-          tar -xzf /tmp/ksail.tar.gz -C /tmp
-          sudo install /tmp/ksail /usr/local/bin/ksail
-          ksail --version
+          .github/scripts/setup-ksail.sh
 
       - name: 📥 Restore kubeconform schema cache
         # ksail's kubeconform client fetches JSON schemas from

.github/workflows/dr-rebuild.yaml

@@ -74,16 +74,13 @@ jobs:
           persist-credentials: false
 
       - name: ⚙️ Setup KSail
-        # Same install path as ci.yaml's deploy-prod job; renovate keeps the
-        # pin current in both places.
+        # Same verified install path as ci.yaml's validate job and the
+        # deploy-prod action; renovate keeps the pin current in all places.
         env:
           # renovate: datasource=github-releases depName=devantler-tech/ksail extractVersion=^v(?<version>.+)$
           KSAIL_VERSION: "7.175.2"
         run: |
-          curl -fsSL "https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/ksail_${KSAIL_VERSION}_linux_amd64.tar.gz" -o /tmp/ksail.tar.gz
-          tar -xzf /tmp/ksail.tar.gz -C /tmp
-          sudo install /tmp/ksail /usr/local/bin/ksail
-          ksail --version
+          .github/scripts/setup-ksail.sh
 
       - name: ⚙️ Setup talosctl
         # The GHCR bridge verifies RegistryAuthConfig on each stale node.