Housekeeping: checksums, workflow permissions, README.md

.github/workflows/docker-all.yml

@@ -3,6 +3,9 @@
 
 name: Push alganet/shell-versions:all
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/docker-latest.yml

@@ -3,6 +3,9 @@
 
 name: Push alganet/shell-versions:latest
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/docker-test.yml

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: ISC
 
 name: Push alganet/shell-versions:test
+
 permissions:
   contents: read
 

.github/workflows/test-verification.yml → .github/workflows/workflow-verification.yml

@@ -1,4 +1,7 @@
-name: Checksum Verification
+name: Workflow Verification
+
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -8,13 +11,32 @@ on:
   workflow_dispatch:
 
 jobs:
+  verify-workflows:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v3
+      - name: Check workflow permissions
+        run: |
+          set -e
+          missing=0
+          for f in .github/workflows/*.yml; do
+            if ! grep -q '^[[:space:]]*permissions:' "$f"; then
+              echo "Workflow $f missing 'permissions' key"
+              missing=1
+            fi
+          done
+          if [ "$missing" = 1 ]; then
+            echo "One or more workflows are missing the 'permissions' stanza."
+            exit 1
+          fi
+
   verify-checksums:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v3
 
-      - name: 'Fast verify: successful download (dash)'
+      - name: 'Download Verification'
         run: |
           set -ex
           # ensure clean state and perform an initial download (should succeed)
@@ -25,9 +47,9 @@ jobs:
         run: |
           set -ex
           # backup checksum file
-          cp checksums/dash/0.5.13.tar.gz.sha256sums checksums/dash/0.5.13.tar.gz.sha256sums.bak
+          cp checksums/sources/dash/0.5.13.tar.gz.sha256sums checksums/sources/dash/0.5.13.tar.gz.sha256sums.bak
           # corrupt checksum: replace hash with ones; keep filename
-          printf '1111111111111111111111111111111111111111111111111111111111111111  %s\n' "0.5.13.tar.gz" > checksums/dash/0.5.13.tar.gz.sha256sums
+          printf '1111111111111111111111111111111111111111111111111111111111111111  %s\n' "0.5.13.tar.gz" > checksums/sources/dash/0.5.13.tar.gz.sha256sums
           # remove any existing artifact to force re-download
           rm -f build/dash/0.5.13.tar.gz
           set +e
@@ -55,6 +77,6 @@ jobs:
       - name: 'Restore checksum and verify success'
         run: |
           set -ex
-          mv checksums/dash/0.5.13.tar.gz.sha256sums.bak checksums/dash/0.5.13.tar.gz.sha256sums
+          mv checksums/sources/dash/0.5.13.tar.gz.sha256sums.bak checksums/sources/dash/0.5.13.tar.gz.sha256sums
           rm -f build/dash/0.5.13.tar.gz
           sh shvr.sh download dash_0.5.13

README.md

@@ -87,20 +87,3 @@ This is particularly useful if you want to test a version that we don't bundle
 by default, such as an old patch. Our scripts are able to build most
 intermediate versions without modifications, but we can't include them all in
 any of the default images.
-
-## Checksums and Verification
-
-This repository includes a `checksums/` directory that mirrors the layout in
-`build/` and contains `.sha256sums` files for each downloaded artifact. The
-build process verifies downloads against these checksums and will fail fast
-if checksums are missing or do not match.
-
-To generate checksum files for existing `build/` artifacts, use:
-
-```sh
-sh shvr.sh generate_checksums
-```
-
-Checksums are used automatically by our `shvr_fetch` helper by default. To
-disable verification set `SHVR_SKIP_VERIFY_SHA256=1` (not recommended unless
-you need a temporary bypass).

checksums/README.md

@@ -0,0 +1,16 @@
+## Checksums and Verification
+
+The `checksums/sources` directory contains `.sha256sums` files for each
+downloaded artifact. The build process verifies downloads against these
+checksums and will fail fast if checksums are missing or do not match.
+
+To generate checksum files for the sources, use:
+
+```sh
+$ sh shvr.sh download $(sh shvr.sh targets)
+$ sh shvr.sh generate_checksums
+```
+
+Checksums are used automatically by our `shvr_fetch` helper by default. To
+disable verification set `SHVR_SKIP_VERIFY_SHA256=1` (not recommended unless
+you need a temporary bypass).