Context
Currently downloading Wasm SDKs from Swift.org without checksum validation (line 808-824 in action.yml).
Blocker
Swift.org does not currently publish checksums for Wasm SDK artifact bundles.
Security Benefit
Prevents supply chain attacks via tampered SDK downloads.
Implementation
Add checksum verification before swift sdk install when checksums become available.
Reference
Swift.org download pattern and SDK installation at action.yml:806-824
Current Code Location
# action.yml:808
# TODO: Add checksum validation when Swift.org publishes checksums for Wasm SDKs
SDK_URL="https://download.swift.org/swift-${SWIFT_VERSION}-release/wasm-sdk/swift-${SWIFT_VERSION}-RELEASE/${SDK_NAME}.artifactbundle.tar.gz"
Related
Part of PR review recommendations for #81 (1.5.0 release)
Context
Currently downloading Wasm SDKs from Swift.org without checksum validation (line 808-824 in action.yml).
Blocker
Swift.org does not currently publish checksums for Wasm SDK artifact bundles.
Security Benefit
Prevents supply chain attacks via tampered SDK downloads.
Implementation
Add checksum verification before
swift sdk installwhen checksums become available.Reference
Swift.org download pattern and SDK installation at action.yml:806-824
Current Code Location
Related
Part of PR review recommendations for #81 (1.5.0 release)