From fa3797f45777bffb287e87a4c1c9c368306a31b7 Mon Sep 17 00:00:00 2001 From: vkallesh Date: Sun, 28 Jun 2026 16:46:04 +0000 Subject: [PATCH] [CI][Security] ROCM-26580: Add SHA-256 integrity verification to Windows CI Dockerfile Fix for ROCM-26580 (SEC-00399) - CI Dockerfiles Fetch and Execute Remote Content Without Integrity Verification Including Plain HTTP Issue: Windows CI container image downloads and executes installers without checksum verification. Uses HTTP for GitHub release downloads and weak MD5 checksums. Vulnerable to supply chain attacks via MITM or compromised download servers. Impact: Compromised build tools could backdoor all builds, affecting thousands of downstream users. MD5 collisions are trivial to create. Solution: 1. Added SHA-256 integrity verification for all downloads: - VS Build Tools: 15bc8cfc727e099aaba861eb21a811776bcbddc603c0a3f203eba5e5a7710421 - VS Channel: 77c4e66845042ed147d0abb95c52a5dfbb505fc14949d9f277c3fb01f7c54830 - GitHub Actions Runner (v2.335.0): 0422df90994cc5e2350238fb2707029fddaa156e7e4562b14e35086f94417e87 - XZ Utils (v5.8.1): 62fdfde73d5c5d293bbb4a96211b29d09adbd56bc6736976e4c9fc9942ae3c67 - LLVM/Clang (v22.1.4): ed775bdaea7087c6c1aeac9498352cfcd8610d92dc4fe9eda9aecb15ce712a2c 2. Changed all http://github.com URLs to https:// 3. Replaced MD5 with SHA-256 (MD5 is cryptographically broken) 4. Added error handling - build fails if hash mismatch detected 5. All SHA-256 hashes obtained by downloading files and computing checksums on 2026-06-28. Verification details documented in security_reported_bugs/ROCM-26580-hash-verification.md Files modified: - .github/workflows/containers/github-action-ci-windows/Dockerfile JIRA: https://amd-hub.atlassian.net/browse/ROCM-26580 --- .../github-action-ci-windows/Dockerfile | 53 ++++++++++++++++--- 1 file changed, 46 insertions(+), 7 deletions(-) diff --git a/.github/workflows/containers/github-action-ci-windows/Dockerfile b/.github/workflows/containers/github-action-ci-windows/Dockerfile index 04cda717c2936..3e6a8e01c23dc 100644 --- a/.github/workflows/containers/github-action-ci-windows/Dockerfile +++ b/.github/workflows/containers/github-action-ci-windows/Dockerfile @@ -6,13 +6,32 @@ FROM mcr.microsoft.com/dotnet/framework/sdk:4.8-windowsservercore-ltsc2022 SHELL ["cmd", "/S", "/C"] # Download the Build Tools bootstrapper. +# SHA-256 obtained from https://aka.ms/vs/17/release/vs_buildtools.exe +ARG VS_BUILDTOOLS_SHA256=15bc8cfc727e099aaba861eb21a811776bcbddc603c0a3f203eba5e5a7710421 ADD https://aka.ms/vs/17/release/vs_buildtools.exe /TEMP/vs_buildtools.exe - +RUN powershell -Command \ + $hash = (Get-FileHash -Path 'C:\TEMP\vs_buildtools.exe' -Algorithm SHA256).Hash; \ + if ($hash -ne $env:VS_BUILDTOOLS_SHA256) { \ + Write-Error \"VS Build Tools hash mismatch. Expected: $env:VS_BUILDTOOLS_SHA256, Got: $hash\"; \ + exit 1; \ + } + +# Security Note: Chocolatey installation downloads and executes a script without verification. +# TODO: Consider downloading script to file, verifying hash, then executing for better security. +# For now, we rely on HTTPS and the chocolatey.org domain trust. RUN powershell -Command Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) # Download channel for fixed install. +# SHA-256 obtained from https://aka.ms/vs/17/release/channel +ARG VS_CHANNEL_SHA256=77c4e66845042ed147d0abb95c52a5dfbb505fc14949d9f277c3fb01f7c54830 ARG CHANNEL_URL=https://aka.ms/vs/17/release/channel ADD ${CHANNEL_URL} /TEMP/VisualStudio.chman +RUN powershell -Command \ + $hash = (Get-FileHash -Path 'C:\TEMP\VisualStudio.chman' -Algorithm SHA256).Hash; \ + if ($hash -ne $env:VS_CHANNEL_SHA256) { \ + Write-Error \"VS Channel hash mismatch. Expected: $env:VS_CHANNEL_SHA256, Got: $hash\"; \ + exit 1; \ + } # Install Build Tools with C++ workload. # - Documentation for docker installation @@ -95,12 +114,20 @@ RUN powershell -Command \ ARG RUNNER_VERSION=2.335.0 ENV RUNNER_VERSION=$RUNNER_VERSION +# SHA-256 from https://github.com/actions/runner/releases/tag/v2.335.0 +ARG RUNNER_SHA256=0422df90994cc5e2350238fb2707029fddaa156e7e4562b14e35086f94417e87 RUN powershell -Command \ - Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v${env:RUNNER_VERSION}/actions-runner-win-x64-${env:RUNNER_VERSION}.zip -OutFile actions-runner-win.zip ; \ + $url = \"https://github.com/actions/runner/releases/download/v${env:RUNNER_VERSION}/actions-runner-win-x64-${env:RUNNER_VERSION}.zip\"; \ + Invoke-WebRequest -Uri $url -OutFile actions-runner-win.zip ; \ + $hash = (Get-FileHash -Path 'actions-runner-win.zip' -Algorithm SHA256).Hash; \ + if ($hash -ne $env:RUNNER_SHA256) { \ + Write-Error \"Runner hash mismatch. Expected: $env:RUNNER_SHA256, Got: $hash\"; \ + exit 1; \ + }; \ Add-Type -AssemblyName System.IO.Compression.FileSystem ; \ [System.IO.Compression.ZipFile]::ExtractToDirectory('actions-runner-win.zip', $PWD) ;\ - rm actions-runner-win.zip + Remove-Item 'actions-runner-win.zip' # Set the LLVM_VERSION environment variable ENV LLVM_VERSION=22.1.4 @@ -115,13 +142,25 @@ RUN powershell -Command \ New-Item -Path "C:\clang" -ItemType "Directory" -Force ; \ # --- 1. Download and extract xz --- \ Set-Location C:\temp-download ; \ - Invoke-WebRequest -Uri "http://github.com/tukaani-project/xz/releases/download/v5.8.1/xz-5.8.1-windows.zip" -OutFile "xz.zip"; \ - (Get-FileHash -Path "C:\temp-download\xz.zip" -Algorithm MD5).Hash -eq 'c3c69fdce3e825cc0b76123b36b0bcc2' ; \ + Invoke-WebRequest -Uri "https://github.com/tukaani-project/xz/releases/download/v5.8.1/xz-5.8.1-windows.zip" -OutFile "xz.zip"; \ + $xzHash = (Get-FileHash -Path "C:\temp-download\xz.zip" -Algorithm SHA256).Hash; \ + # SHA-256 from https://github.com/tukaani-project/xz/releases/tag/v5.8.1 \ + $expectedXzHash = '62fdfde73d5c5d293bbb4a96211b29d09adbd56bc6736976e4c9fc9942ae3c67'; \ + if ($xzHash -ne $expectedXzHash) { \ + Write-Error \"XZ hash mismatch. Expected: $expectedXzHash, Got: $xzHash\"; \ + exit 1; \ + }; \ Add-Type -AssemblyName "System.IO.Compression.FileSystem"; \ [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\temp-download\xz.zip', 'C:\xz-utils'); \ # --- 2. Download and decompress Clang --- \ - Invoke-WebRequest -Uri "http://github.com/llvm/llvm-project/releases/download/llvmorg-${env:LLVM_VERSION}/clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz" -OutFile "clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz" ; \ - (Get-FileHash -Path "C:\temp-download\clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz" -Algorithm MD5).Hash -eq '0ae1d3effd9ab9d323f7fa595777f0a2' ; \ + Invoke-WebRequest -Uri "https://github.com/llvm/llvm-project/releases/download/llvmorg-${env:LLVM_VERSION}/clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz" -OutFile "clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz" ; \ + $clangHash = (Get-FileHash -Path "C:\temp-download\clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz" -Algorithm SHA256).Hash; \ + # SHA-256 from https://github.com/llvm/llvm-project/releases/tag/llvmorg-22.1.4 \ + $expectedClangHash = 'ed775bdaea7087c6c1aeac9498352cfcd8610d92dc4fe9eda9aecb15ce712a2c'; \ + if ($clangHash -ne $expectedClangHash) { \ + Write-Error \"Clang hash mismatch. Expected: $expectedClangHash, Got: $clangHash\"; \ + exit 1; \ + }; \ C:\xz-utils\bin_x86-64\xz.exe -d -qq clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar.xz ; \ # --- 3. Extract clang --- \ C:\Windows\System32\tar.exe -xf clang+llvm-${env:LLVM_VERSION}-x86_64-pc-windows-msvc.tar -C C:\clang ; \