Repository navigation
ci: yq is fetched from the floating latest release and installed as root in four privileged workflows #3640
Description
Activity
Same pattern, another tool: the flux install in the build workflows.
Set up build toolchaininstalls flux from the upstream bootstrap with no version pin and no retry:if ! command -v flux >/dev/null; then install_script="$(mktemp)" curl -fsSL https://fluxcd.io/install.sh -o "$install_script" sudo bash "$install_script" rm -f "$install_script" fiWith no
FLUX_VERSIONin the environment,install.shresolves the floatinglatestand fetchesflux_<latest>_checksums.txtin a single unauthenticatedcurl -f. This copy of the block lives inpull-requests.yaml,build-release.yaml,build-main.yamlandtags.yaml.It already broke a build. On #4429 the
Build packages/system/backupstrategy-controllerjob failed inSet up build toolchain:[INFO] Using 2.9.5 as release [INFO] Downloading hash https://github.com/fluxcd/flux2/releases/download/v2.9.5/flux_2.9.5_checksums.txt ##[error]Process completed with exit code 22.curl -fexit 22 means the server returned HTTP >= 400 on that request. The asset is fine (it serves 200 now, v2.9.5 is a real release) and only that one matrix job failed while every sibling running the same step passed, so this was a transient 4xx on the release CDN, not a broken release and not the PR (which does not touch backupstrategy-controller). Unpinnedlatestplus no retry turns a momentary GitHub blip into a red build.The fix pattern already exists one step above it: in the same
pull-requests.yaml,Set up promotion toolchainpinsFLUX_VERSION: "2.8.6"and installs only when that exact version is absent. The build-toolchain steps are the exception, the same way yq is. Folding flux into the shared pinned install this issue proposes, or at minimum passingFLUX_VERSIONand addingcurl --retry, would close both.- added 2 commits that reference this issue
on Sep 24, 2026
Summary
Four workflows install
yqat run time withsudo curl -sSL -o /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64—promote-rc.yaml,pull-requests-release.yaml,nightly.yaml,tags.yaml. The binary is fetched from the floatinglatestrelease, with no version pin and no checksum, and installed as root. Every copy is the same block, so this looks like one pattern propagated by copying.Why it matters
These are exactly the privileged workflows: promotion, release finalization, nightly image mirroring, tag publishing. A compromised or merely broken
latestrelease lands directly in the jobs that hold registry and release credentials, and a behavior change in a new yq major (which has happened before in yq's history) changes what gets promoted without any diff in this repository. The rest of the toolchain in these jobs is pinned; yq is the exception.Fix shape
Pin a version and verify a checksum in one shared place, in the same spirit as the existing shared image-refs enumeration: either a small
hack/install script the four workflows call, or a composite action. Bumping the pin then becomes an ordinary reviewable diff.