mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-10-15 16:22:06 +00:00
Daniel Hilst
380fccd625
The workflow step that puts the arm64-efi GRUB modules on the runner read a directory listing over plain HTTP, took the last name in lexical order, and unpacked the whole deb into / as root. Nothing authenticated the artifact, and the name chosen was neither tied to the runner's suite nor to the installed grub-mkimage. install-grub-arm64-modules.sh now reads grub-efi-arm64-bin through apt in a private state tree: apt verifies the InRelease signature of the suite that /etc/os-release names, and the deb hash against that signed index. The host dpkg architecture and the host sources are not changed. The script stops when the deb and the host grub-mkimage report different GRUB upstream versions, unpacks under TMPDIR, and copies only the files of usr/lib/grub/arm64-efi. The documentation and the prebuilt images under monolithic/ stay out. t/install-grub-arm64-modules.bats drives the script with apt-get, dpkg-deb and the image builder as shell functions. Four removals were each caught by the assertion that names them: the version gate, the file-only copy, the apt authentication options, and the missing-module-directory check. Measured in an ubuntu:24.04 container with the workflow's own steps: t/aarch64_target.t reports 4 skips before the step and 0 after it, with all 38 checks passing, and t/aarch64_cross_build.t passes 27 with 0 skips. Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>