CI: containerd-sha is not verified (only affects tests)

[AkihiroSuda]

nerdctl/.github/workflows/workflow-test.yml

Lines 149 to 151 in bf9d3d2

	containerd-version: 2.2.0
	# Note: these as for amd64
	containerd-sha: 8a7956e91a33bca10b13b196df00e73acebb7f3931e0d1456c0209139f96251b

The sha256 value does not seem verified in the CI, as the value seems taken from v2.2.0-rc.0, not from v2.2.0: https://github.com/containerd/containerd/releases/tag/v2.2.0-rc.0

This issue only affects the tests, so I'm not treating this as a vulnerability.

[AkihiroSuda]

Maybe the sha is invalidated here?

nerdctl/.github/workflows/job-test-in-host.yml

Lines 88 to 91 in 7d79937

	[ "${latest_containerd:1}" == "$CONTAINERD_VERSION" ] || {
	printf "CONTAINERD_VERSION=%s\n" "${latest_containerd:1}" >> "$GITHUB_ENV"
	printf "CONTAINERD_SHA=canary is volatile and I accept the risk\n" >> "$GITHUB_ENV"
	}

cc @apostasie

[Shubhranshu153]

Seems like we dont need the SHA check here, as the version check is only used to check whether we should run the canary or not. Not really verifying the artifacts installed or packaging.

[apostasie]

@AkihiroSuda I'll have a look in the upcoming few days.

[apostasie]

in-host tests are ran for:

• windows (regular and canary)

• docker (just regular, no canary)

• NOT for nerdctl

1. for windows, the sha is NEVER verified - this is a limitation of https://github.com/containerd/nerdctl/blob/bf9d3d28861489ed27c20973348bc43fb9dba771/hack/provisioning/windows/containerd.ps1 and should be fixed

2. for docker/linux, we do not test on canary, so, the sha should always be verified.

nerdctl/hack/provisioning/linux/containerd.sh

Lines 54 to 63 in bf9d3d2

	if [ "$bin_sha" == "canary is volatile and I accept the risk" ]; then
	http::get \
	containerd.tar.gz \
	https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz
	else
	http::get::secure \
	containerd.tar.gz \
	https://github.com/containerd/containerd/releases/download/v"$version"/containerd-"$version"-linux-"$arch".tar.gz \
	"$bin_sha"
	fi

From what I can see on a recent run:

https://github.com/containerd/nerdctl/actions/runs/20521112814/job/58956486404?pr=4676#step:5:24

The sha and version match, but this is a more recent one than the one you refer to:

dmp@Synchronicity:~/Projects/go/farcloser/quark$ curl -fSsL https://github.com/containerd/containerd/releases/download/v2.2.1/containerd-2.2.1-linux-amd64.tar.gz | sha256
f5d8e90ecb6c1c7e33ecddf8cc268a93b9e5b54e0e850320d765511d76624f41

3. nerdctl/linux is tested in-container (different pipeline)

I will send a test PR to validate in a minute.

[apostasie]

So, here is the take-away: in-host tests are only for docker (that does not install containerd <- I earlier said it did, but it does not), and windows.

This sha would matter (and would fail) IF we were testing linux/nerdctl in-host.

Bottom-line: containerd hash is properly verified for nerdctl (in-container) tests, and will be in-host when we test nerdctl there.

IMO, what remains of this bug here is duplicative of #4163 (eg: windows installers do not verify sha).

Let me know if I am missing something.

Enjoy the holiday folks!

[apostasie]

Seems like we dont need the SHA check here, as the version check is only used to check whether we should run the canary or not. Not really verifying the artifacts installed or packaging.

We should keep it. This will be used when we test nerdctl in-host by the containerd provisioning script (logic is in place).