Context
We pin 1Password/load-secrets-action as a GitHub Action in apache/infrastructure-actions, which runs an automated action-verification gate on dependency bumps. The gate flags the CLI installer as an unverified binary download in four source files (src/op-cli-installer/github-action/cli-installer/{cli-installer,macos,windows}.ts, src/op-cli-installer/version/helper.ts).
The installer downloads the op CLI from
https://cache.agilebits.com/dist/1P/op2/pkg/{version}/op_<platform>_<arch>_<version>.zip
via tc.downloadTool(...) and immediately tc.extractZip(...)s it — with no SHA256/signature check on the downloaded artifact before use. This blocks us (and any consumer running similar supply-chain checks) from bumping past 4.0.0.
Request: verify the download before extracting — e.g. fetch a published SHA256 for the artifact and compare, or verify a signature (minisign/GPG/cosign) over it. As a security vendor you likely already publish the necessary checksums/signatures for the CLI; surfacing and checking them in the installer would let downstream verification trust the install.
Happy to help if useful.
Context
We pin
1Password/load-secrets-actionas a GitHub Action inapache/infrastructure-actions, which runs an automated action-verification gate on dependency bumps. The gate flags the CLI installer as an unverified binary download in four source files (src/op-cli-installer/github-action/cli-installer/{cli-installer,macos,windows}.ts,src/op-cli-installer/version/helper.ts).The installer downloads the
opCLI fromvia
tc.downloadTool(...)and immediatelytc.extractZip(...)s it — with no SHA256/signature check on the downloaded artifact before use. This blocks us (and any consumer running similar supply-chain checks) from bumping past 4.0.0.Request: verify the download before extracting — e.g. fetch a published SHA256 for the artifact and compare, or verify a signature (
minisign/GPG/cosign) over it. As a security vendor you likely already publish the necessary checksums/signatures for the CLI; surfacing and checking them in the installer would let downstream verification trust the install.Happy to help if useful.