@samitouri / QOS-React / commits / 7e4c258e16

[scripts] Verify artifact integrity when downloading (#32728)

Uses https://cli.github.com/manual/gh_attestation_verify to verify that the downloaded artifact matches the attestation generated during the build process in runtime_commit_artifacts. Example: On a workflow run of runtime_build_and_test.yml with no attestations: ``` $ scripts/release/download-experimental-build.js --commit=ea5f065745b777cb41cc9e54a3b29ed8c727a574 Command failed: gh attestation verify artifacts_combined.zip --repo=facebook/react Error: failed to fetch attestations from facebook/react: HTTP 404: Not Found (https://api.github.com/repos/facebook/react/attestations/sha256:7adba0992ba477a927aad5a07f95ee2deb7d18427c84279d33fc40a3bc28ebaa?per_page=30) `gh attestation verify artifacts_combined.zip --repo=facebook/react` (exited with error code 1) ``` On one which does: ``` $ scripts/release/download-experimental-build.js --commit=12e85d74c1c233cdc2f3228a97473a4435d50c3b ✓ Downloading artifacts from GitHub for commit 12e85d74c1c233cdc2f3228a97473a4435d50c3b) 10.5 secs An experimental build has been downloaded! You can download this build again by running: scripts/download-experimental-build.js --commit=12e85d74c1c233cdc2f3228a97473a4435d50c3b ``` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32728). * #32729 * __->__ #32728

lauren committed Mar 24, 2025 at 18:24 UTC 7e4c258e160d3a2ca690b44a5938271873919ee1
1 file changed +30 -3
scripts/release/shared-commands/download-build-artifacts.js
+30 -3
@@ -3,8 +3,9 @@
3 const {join} = require('path');
4 const theme = require('../theme');
5 const {exec} = require('child-process-promise');
6 -const {existsSync, readFileSync} = require('fs');
6 +const {existsSync, mkdtempSync, readFileSync} = require('fs');
7 const {logPromise} = require('../utils');
8 +const os = require('os');
9
10 if (process.env.GH_TOKEN == null) {
11 console.log(
@@ -21,6 +22,15 @@ const GITHUB_HEADERS = `
22 -H "Authorization: Bearer ${process.env.GH_TOKEN}" \
23 -H "X-GitHub-Api-Version: 2022-11-28"`.trim();
24
25 +async function executableIsAvailable(name) {
26 + try {
27 + await exec(`which ${name}`);
28 + return true;
29 + } catch (_error) {
30 + return false;
31 + }
32 +}
33 +
34 function sleep(ms) {
35 return new Promise(resolve => setTimeout(resolve, ms));
36 }
@@ -78,10 +88,27 @@ async function getArtifact(workflowRunId, artifactName) {
88 async function processArtifact(artifact, commit, releaseChannel) {
89 // Download and extract artifact
90 const cwd = join(__dirname, '..', '..', '..');
91 + const tmpDir = mkdtempSync(join(os.tmpdir(), 'react_'));
92 await exec(`rm -rf ./build`, {cwd});
93 await exec(
83 - `curl -L ${GITHUB_HEADERS} ${artifact.archive_download_url} \
84 - > a.zip && unzip a.zip -d . && rm a.zip build2.tgz && tar -xvzf build.tgz && rm build.tgz`,
94 + `curl -L ${GITHUB_HEADERS} ${artifact.archive_download_url} > artifacts_combined.zip`,
95 + {
96 + cwd: tmpDir,
97 + }
98 + );
99 +
100 + // Use https://cli.github.com/manual/gh_attestation_verify to verify artifact
101 + if (executableIsAvailable('gh')) {
102 + await exec(
103 + `gh attestation verify artifacts_combined.zip --repo=${OWNER}/${REPO}`,
104 + {
105 + cwd: tmpDir,
106 + }
107 + );
108 + }
109 +
110 + await exec(
111 + `unzip ${tmpDir}/artifacts_combined.zip -d . && rm build2.tgz && tar -xvzf build.tgz && rm build.tgz`,
112 {
113 cwd,
114 }