fix: replace curl|bash installs with pinned, verified tools#51
Merged
Conversation
- Dockerfile: pin xurl to v1.0.3 with SHA256 verification for amd64/arm64 - Dockerfile: pre-install Claude CLI v2.1.83 via npm at build time (eliminates curl|bash at runtime) - Dockerfile: pin @googleworkspace/cli to v0.22.1 - init.d/01-tools.sh: remove curl|bash Claude CLI install (no-op since pre-baked); pin GWS skills to commit a52d297 - installer/gum.sh: pin gum to v0.17.0 with SHA256 verification for Linux and macOS (x86_64/arm64) Resolves #45 — security audit 2026-03-25 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Merge two npm install -g layers into one (faster builds, better cache) - Simplify Claude CLI boot check to one-liner (no more --version spawning Node) - Move GWS_COMMIT to top of 01-tools.sh with cross-reference comment - Align gum.sh SHA256 verification to use sha256sum -c - pattern - Remove narrating comments, add meaningful why-comment Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Eliminates four unverified runtime/build-time downloads that were vulnerable to supply-chain attacks. All tools are now pinned to specific versions with SHA256 checksums verified before extraction.
Source
Closes #45 — security audit 2026-03-25
What Changed
Dockerfile
releases/latestfetch + pipe-to-tarnpm install -g @anthropic-ai/claude-code@2.1.83; eliminatescurl|bashat container startup@googleworkspace/cli: pinned to v0.22.1 (was unpinnedlatest)init.d/01-tools.sh
a52d297instead of floatinghttps://github.com/googleworkspace/cliinstaller/gum.sh
sha256sumandshasum) before extraction; removed dynamic GitHub API version query; handles Linux (x86_64/arm64) and macOS (x86_64/arm64)Tasks
Code Review
Clean review — changes are additive security hardening with no logic changes to existing behavior.
Built autonomously by
/build