deepscan fixes

- validate hashes of manifest command
- check non-err non-nil path for redirects in routes
- better build security
- use local mime.types copy
- more hash verification for Docker build, update goreleaser
- more guarantees for LFU
- improve bonding logic
- further confine local FS reads, especially on Windows
- deal with range bytes=0-0

Author: chocolatkey

.github/workflows/build.yml

@@ -12,14 +12,21 @@ permissions:
 jobs:
 
   build:
-    runs-on: [self-hosted, arm64]
+    # Fork PRs run attacker-controlled code (both the workflow definition and
+    # `go test`), so they must never run on the self-hosted runners shared
+    # with the release pipeline.
+    runs-on: ubuntu-26.04-arm
+    permissions:
+      contents: read
     steps:
     - name: Harden Runner
       uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
       with:
         egress-policy: audit
 
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Set up Go
       uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0

Dockerfile

@@ -2,9 +2,15 @@ FROM --platform=$BUILDPLATFORM golang:1-bookworm@sha256:386d475a660466863d9f8c76
 ARG BUILDARCH TARGETOS TARGETARCH
 ARG NO_SNAPSHOT=false
 
-# Install GoReleaser
-RUN wget --no-verbose "https://github.com/goreleaser/goreleaser/releases/download/v2.8.2/goreleaser_2.8.2_$BUILDARCH.deb"
-RUN dpkg -i "goreleaser_2.8.2_$BUILDARCH.deb"
+# Install GoReleaser, verifying the package against the SHA256 sums published
+# in the release's checksums.txt so a swapped release asset fails the build
+RUN wget --no-verbose "https://github.com/goreleaser/goreleaser/releases/download/v2.17.0/goreleaser_2.17.0_$BUILDARCH.deb" && \
+    case "$BUILDARCH" in \
+      amd64) echo "9dd79854c7e3d87699764fdf5469f111c6d68449943bc83b4f51446e10166996  goreleaser_2.17.0_amd64.deb" | sha256sum -c - ;; \
+      arm64) echo "5bf732ad34ece73243209525d58a02df546aa2a0e25106631d4058bfd42fad1d  goreleaser_2.17.0_arm64.deb" | sha256sum -c - ;; \
+      *) echo "no pinned goreleaser checksum for build architecture $BUILDARCH" >&2; exit 1 ;; \
+    esac
+RUN dpkg -i "goreleaser_2.17.0_$BUILDARCH.deb"
 
 # Create and change to the app directory.
 WORKDIR /app
@@ -33,7 +39,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 # RUN go test ./...
 
 # Produces very small images
-FROM gcr.io/distroless/static-debian12 AS packager
+FROM gcr.io/distroless/static-debian12@sha256:a9fcaedd4c9b59e12dd65d954f0b5044f19b0647a8a3712e77205df9e7b102cd AS packager
 
 # Extra metadata
 LABEL org.opencontainers.image.source="https://github.com/readium/cli"
@@ -43,7 +49,10 @@ LABEL org.opencontainers.image.source="https://github.com/readium/cli"
 # this file as part of its mime package, and readium/go-toolkit
 # has a mediatype package that falls back to Go's mime
 # package to discover a file's mimetype when all else fails.
-ADD https://pagure.io/mailcap/raw/master/f/mime.types /etc/
+# Vendored into the repository (from https://pagure.io/mailcap)
+# so builds are reproducible and don't fetch from a mutable ref.
+# ADD https://pagure.io/mailcap/raw/master/f/mime.types /etc/
+COPY mime.types /etc/
 
 # Add demo EPUBs to the container by default
 # ADD --chown=nonroot:nonroot https://readium-playground-files.storage.googleapis.com/demo/moby-dick.epub /srv/publications/

internal/cli/manifest.go

@@ -105,12 +105,12 @@ Examples:
 
 		// Images in directory to ignore for accessibility inference
 		if inferIgnoreImageDirectoryFlag != "" {
-			ignoreableImageHashAlgorithms := make([]manifest.HashAlgorithm, len(hash))
 			if len(hash) == 0 {
 				return fmt.Errorf("no hash algorithms provided for hashing images in ignored image directory")
 			}
-			for i, h := range hash {
-				ignoreableImageHashAlgorithms[i] = manifest.HashAlgorithm(h)
+			ignoreableImageHashAlgorithms, err := parseHashAlgorithms(hash)
+			if err != nil {
+				return err
 			}
 
 			entries, err := os.ReadDir(inferIgnoreImageDirectoryFlag)
@@ -175,9 +175,9 @@ Examples:
 		}
 
 		if inspectImagesFlag {
-			hashAlgorithms := make([]manifest.HashAlgorithm, len(hash))
-			for i, h := range hash {
-				hashAlgorithms[i] = manifest.HashAlgorithm(h)
+			hashAlgorithms, err := parseHashAlgorithms(hash)
+			if err != nil {
+				return err
 			}
 			inspector := &helpers.ImageInspector{
 				Algorithms: hashAlgorithms,
@@ -206,10 +206,25 @@ Examples:
 		}
 
 		fmt.Println(string(jsonBytes))
-		return err
+		return nil
 	},
 }
 
+// Validate algorithms
+func parseHashAlgorithms(names []string) ([]manifest.HashAlgorithm, error) {
+	algorithms := make([]manifest.HashAlgorithm, len(names))
+	for i, h := range names {
+		switch a := manifest.HashAlgorithm(strings.ToLower(h)); a {
+		// Algos accepted by image inspector
+		case manifest.HashAlgorithmSHA256, manifest.HashAlgorithmMD5, manifest.HashAlgorithmPhashDCT, "https://blurha.sh":
+			algorithms[i] = a
+		default:
+			return nil, fmt.Errorf("unsupported hash algorithm: %s", h)
+		}
+	}
+	return algorithms, nil
+}
+
 func init() {
 	rootCmd.AddCommand(manifestCmd)
 	manifestCmd.Flags().StringVarP(&indentFlag, "indent", "i", "", "Indentation used to pretty-print")

internal/cli/serve.go

@@ -5,7 +5,6 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"fmt"
-	"log"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -179,7 +178,7 @@ access to publications and prevent abuse or unauthorized access.`,
 			}
 			cfg, err := config.LoadDefaultConfig(ctx, options...)
 			if err != nil {
-				log.Fatal(err)
+				return fmt.Errorf("failed loading AWS config: %w", err)
 			}
 			_, err = cfg.Credentials.Retrieve(ctx)
 			if err == nil {