From 05bd3e543738d1f09124dfc6064124db345db643 Mon Sep 17 00:00:00 2001 From: Robert Maynard Date: Tue, 28 Apr 2026 11:12:32 -0400 Subject: [PATCH] ci: Validate that the rvm-installer comes from the correct source Based on guidance from https://rvm.io/rvm/security to make sure we get rvm-installer from the correct source. --- .gitlab/ci/docker/debian13-x86_64/install_rvm.sh | 5 ++++- .gitlab/ci/docker/fedora43/build_rvm.sh | 5 ++++- .gitlab/os-linux.yml | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.gitlab/ci/docker/debian13-x86_64/install_rvm.sh b/.gitlab/ci/docker/debian13-x86_64/install_rvm.sh index 1ad42c4580..3e76005d4a 100755 --- a/.gitlab/ci/docker/debian13-x86_64/install_rvm.sh +++ b/.gitlab/ci/docker/debian13-x86_64/install_rvm.sh @@ -8,7 +8,10 @@ gpg2 --keyserver hkps://keyserver.ubuntu.com \ --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 \ 7D2BAF1CF37B13E2069D6956105BD0E739499BDB -curl -sSL https://get.rvm.io | bash -s stable +curl -sSL https://raw.githubusercontent.com/rvm/rvm/stable/binscripts/rvm-installer -o rvm-installer && +curl -sSL https://raw.githubusercontent.com/rvm/rvm/stable/binscripts/rvm-installer.asc -o rvm-installer.asc && +gpg2 --verify rvm-installer.asc rvm-installer && +bash rvm-installer stable # keep version in sync with `env_debian*_ninja.sh` /usr/local/rvm/bin/rvm install ruby-3.2.2 diff --git a/.gitlab/ci/docker/fedora43/build_rvm.sh b/.gitlab/ci/docker/fedora43/build_rvm.sh index 22c4333e4c..9da34fe594 100755 --- a/.gitlab/ci/docker/fedora43/build_rvm.sh +++ b/.gitlab/ci/docker/fedora43/build_rvm.sh @@ -8,7 +8,10 @@ gpg2 --keyserver hkps://keyserver.ubuntu.com \ --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 \ 7D2BAF1CF37B13E2069D6956105BD0E739499BDB -curl -sSL https://get.rvm.io | bash -s stable --ignore-dotfiles +curl -sSL https://raw.githubusercontent.com/rvm/rvm/stable/binscripts/rvm-installer -o rvm-installer && +curl -sSL https://raw.githubusercontent.com/rvm/rvm/stable/binscripts/rvm-installer.asc -o rvm-installer.asc && +gpg2 --verify rvm-installer.asc rvm-installer && +bash rvm-installer stable --ignore-dotfiles export rvm_silence_banner=1 diff --git a/.gitlab/os-linux.yml b/.gitlab/os-linux.yml index 5e6f1ee5ad..f23369944b 100644 --- a/.gitlab/os-linux.yml +++ b/.gitlab/os-linux.yml @@ -58,7 +58,7 @@ ### Debian .debian13: - image: "kitware/cmake:ci-debian13-x86_64-2026-02-08" + image: "kitware/cmake:ci-debian13-x86_64-2026-04-28" variables: GIT_CLONE_PATH: "$CI_BUILDS_DIR/cmake ci" @@ -82,7 +82,7 @@ ### Fedora .fedora43: - image: "kitware/cmake:ci-fedora43-x86_64-2026-02-08" + image: "kitware/cmake:ci-fedora43-x86_64-2026-04-28" variables: GIT_CLONE_PATH: "$CI_BUILDS_DIR/cmake ci/long file name for testing purposes"