Skip to content

fix(security): replace curl|sh installer pipes with download+verify (RGS-018) #43716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 33 commits into from
Jul 8, 2026
Merged

fix(security): replace curl|sh installer pipes with download+verify (RGS-018) #43716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
33 commits
Select commit Hold shift + click to select a range
a357996
Initial plan
Copilot Jul 6, 2026
3eca684
Initial plan checkpoint
Copilot Jul 6, 2026
98a1883
fix(security): replace curl|sh installer patterns with download+verif…
Copilot Jul 6, 2026
d265668
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
pelikhan Jul 6, 2026
0821ca9
fix: use /tmp/gh-aw/ folder for installer temp files
Copilot Jul 6, 2026
5c2c9d0
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
pelikhan Jul 6, 2026
efc3075
fix(security): pin installer refs to resolved SHA in dev-mode templat…
Copilot Jul 6, 2026
157710a
Merge remote-tracking branch 'origin/main' into copilot/static-analys…
Copilot Jul 6, 2026
74b0f64
fix: sh→bash for Ollama, add SHA update docs, trufflehog arch note + …
Copilot Jul 6, 2026
25c13f7
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
github-actions[bot] Jul 6, 2026
e170120
fix(security): pin copilotSetupStepsYAML constant to immutable SHA; a…
Copilot Jul 6, 2026
a27d32d
Merge remote-tracking branch 'origin/main' into copilot/static-analys…
Copilot Jul 6, 2026
b433a83
fix(security): add SHA256 integrity check to dev-mode install-gh-aw.s…
Copilot Jul 6, 2026
d11cf89
fix(security): add input validation guards for SHA values in install …
Copilot Jul 6, 2026
ee63f05
refactor: extract installScriptTempPath constant, simplify sha256 guards
Copilot Jul 6, 2026
2f879c8
refactor: use installScriptTempPath constant in fmt.Sprintf and add c…
Copilot Jul 6, 2026
130bc2c
refactor: extract sha256CheckLine helper to deduplicate sha256sum com…
Copilot Jul 7, 2026
89040e3
docs: document sha256CheckLine trailing newline and parameter safety …
Copilot Jul 7, 2026
996ea42
fix(security): add runtime input validation to sha256CheckLine
Copilot Jul 7, 2026
9b9b24e
fix: add wildcards to path validation in sha256CheckLine; remove redu…
Copilot Jul 7, 2026
83cc016
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
github-actions[bot] Jul 7, 2026
61e0109
refactor(security): extract static SHA/hash constants; add update-ins…
Copilot Jul 7, 2026
b8c2764
feat(makefile): add sync-install-script-hashes target and wire into u…
Copilot Jul 7, 2026
ecba77b
Merge remote-tracking branch 'origin/main' into copilot/static-analys…
Copilot Jul 7, 2026
1512d2b
merge: update from main and recompile lock files (firewall bump to 0.…
Copilot Jul 7, 2026
662e451
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
github-actions[bot] Jul 7, 2026
ae04e75
Merge remote-tracking branch 'origin/main' into copilot/static-analys…
Copilot Jul 7, 2026
0bdb0ef
Merge branch 'main' into copilot/static-analysis-report-2026-07-06
github-actions[bot] Jul 7, 2026
f97f98f
Merge remote-tracking branch 'origin/main' into copilot/static-analys…
Copilot Jul 8, 2026
0ab68ad
test: add init command tests for new download+verify syntax (RGS-018)
Copilot Jul 8, 2026
8a1e3a5
fix(lint): use strings.SplitSeq in range loops (modernize)
Copilot Jul 8, 2026
01373f4
Merge remote-tracking branch 'origin/main' into copilot/static-analys…
Copilot Jul 8, 2026
6555a44
merge: update from main, recompile all lock files
Copilot Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/ab-testing-advisor.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 4 additions & 6 deletions .github/workflows/agent-performance-analyzer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 4 additions & 6 deletions .github/workflows/agent-persona-explorer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/agentic-token-optimizer.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/ai-moderator.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/approach-validator.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 4 additions & 6 deletions .github/workflows/archie.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/artifacts-summary.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/auto-triage-issues.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 3 additions & 4 deletions .github/workflows/avenger.lock.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading