security(ci): verify gitleaks release checksum

Author: asklokesh

.github/workflows/security-audit.yml

@@ -230,6 +230,12 @@ jobs:
           set -euo pipefail
           curl -sSfL -o /tmp/gitleaks.tar.gz \
             https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz
+          # Official v8.30.0 release checksum. Verify before extracting or
+          # executing any downloaded byte; a version-pinned URL alone does not
+          # authenticate an asset that was replaced or corrupted in transit.
+          printf '%s  %s\n' \
+            '79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e' \
+            /tmp/gitleaks.tar.gz | sha256sum -c -
           tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
           /tmp/gitleaks version
 

tests/test-security-scan-coverage.sh

@@ -91,6 +91,7 @@ for step in job.get('steps') or []:
 # summarise or upload its output.
 _PY_SCAN_STEP="$(_step python-audit 'pip-audit every requirements file')"
 _PY_ASSERT_STEP="$(_step python-audit 'Assert the audit actually produced')"
+_SECRET_INSTALL_STEP="$(_step secret-scan 'Install gitleaks')"
 _SECRET_SCAN_STEP="$(_step secret-scan 'gitleaks scan')"
 _SECRET_ASSERT_STEP="$(_step secret-scan 'Assert the secret scan completed cleanly')"
 _SAST_ASSERT_STEP="$(_step sast 'Assert CodeQL SARIF and reject unreviewed critical findings')"
@@ -218,6 +219,27 @@ printf '%s' "$_SECRET_RUNS" | grep -qE "gitleaks/releases/download/v[0-9]" \
   && ok "gitleaks version is pinned" \
   || bad "gitleaks is unpinned -- the baseline can move without a commit"
 
+# Pinning the URL is not enough: a replaced or corrupted release asset would
+# otherwise be extracted and executed with no byte-level provenance check. The
+# digest is the official v8.30.0 linux_x64 release checksum, and verification
+# must happen before extraction so no unauthenticated binary reaches /tmp.
+_gitleaks_linux_x64_sha="79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e"
+_gitleaks_checksum_order="$( _LOKI_BODY="$_SECRET_INSTALL_STEP" \
+  _LOKI_SHA="$_gitleaks_linux_x64_sha" python3 -c "
+import os
+body = os.environ['_LOKI_BODY']
+sha = os.environ['_LOKI_SHA']
+verify = body.find(sha)
+extract = body.find('tar -xzf /tmp/gitleaks.tar.gz')
+print('ok' if verify >= 0 and 'sha256sum -c' in body[verify:extract]
+      and extract > verify else 'missing')
+" 2>/dev/null )"
+if [ "$_gitleaks_checksum_order" = "ok" ]; then
+  ok "gitleaks archive matches the pinned official SHA-256 before extraction"
+else
+  bad "gitleaks archive is executed without the pinned official pre-extraction checksum"
+fi
+
 # --- 8. Secret findings block outside an exact reviewed baseline ------------
 _secret_name="$( _LOKI_WF="$WF" python3 -c "
 import os, yaml