CI: Add integrity check for GitHub Packages (#107)

.github/workflows/prod_integrity_check.yml

@@ -39,3 +39,40 @@ jobs:
           echo "Our hash: $OUR_HASH"
           echo "NPM hash: $NPM_HASH"
           [[ "$NPM_HASH" == "$OUR_HASH" ]]
+  integrity_gh:
+    name: Integrity check (GitHub Packages)
+    runs-on: ubuntu-latest
+    permissions:
+      packages: read
+    steps:
+      - name: Install cosign
+        uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65
+      - name: Get latest version from npm
+        id: get-latest-gh
+        run: |
+          curl -s -L -o "$RUNNER_TEMP/package-gh.json" \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://npm.pkg.github.com/@arx-research%2flibhalo
+          NPM_LATEST_VER=$(cat "$RUNNER_TEMP/package-gh.json" | jq --raw-output '.["dist-tags"].latest' | tr -d '\n')
+          NPM_HASH=$(cat "$RUNNER_TEMP/package-gh.json" | jq --raw-output ".versions[\"${NPM_LATEST_VER}\"].dist.integrity" | tr -d '\n')
+          echo "NPM_LATEST_VER=$NPM_LATEST_VER" >> $GITHUB_ENV
+          echo "NPM_HASH=$NPM_HASH" >> $GITHUB_ENV
+      - name: Check cosign signature
+        run: |
+          curl -s -L -o "$RUNNER_TEMP/libhalo-npm-hash.txt" "https://github.com/arx-research/libhalo/releases/download/libhalo-v${NPM_LATEST_VER}/libhalo-npm-hash.txt"
+          curl -s -L -o "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.pem" "https://github.com/arx-research/libhalo/releases/download/libhalo-v${NPM_LATEST_VER}/libhalo-npm-hash.txt-keyless.pem"
+          curl -s -L -o "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.sig" "https://github.com/arx-research/libhalo/releases/download/libhalo-v${NPM_LATEST_VER}/libhalo-npm-hash.txt-keyless.sig"
+          cosign verify-blob \
+            --cert "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.pem" \
+            --signature "$RUNNER_TEMP/libhalo-npm-hash.txt-keyless.sig" \
+            --certificate-identity "https://github.com/arx-research/libhalo/.github/workflows/prod_build_lib.yml@refs/tags/libhalo-v${NPM_LATEST_VER}" \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "$RUNNER_TEMP/libhalo-npm-hash.txt"
+      - name: Verify integrity hash on npmjs
+        run: |
+          OUR_HASH=$(cat "$RUNNER_TEMP/libhalo-npm-hash.txt" | tr -d '\n')
+          echo "Our hash: $OUR_HASH"
+          echo "NPM hash: $NPM_HASH"
+          [[ "$NPM_HASH" == "$OUR_HASH" ]]

package-lock.json

@@ -1157,9 +1157,9 @@
       "dev": true
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001460",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001460.tgz",
-      "integrity": "sha512-Bud7abqjvEjipUkpLs4D7gR0l8hBYBHoa+tGtKJHvT2AYzLp1z7EmVkUT4ERpVUfca8S2HGIVs883D8pUH1ZzQ==",
+      "version": "1.0.30001462",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001462.tgz",
+      "integrity": "sha512-PDd20WuOBPiasZ7KbFnmQRyuLE7cFXW2PVd7dmALzbkUXEP46upAuCDm9eY9vho8fgNMGmbAX92QBZHzcnWIqw==",
       "dev": true,
       "funding": [
         {
@@ -1230,9 +1230,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.4.321",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.321.tgz",
-      "integrity": "sha512-ERuAqNq7YknVY3+47VbB+Q92kWH7O7sX3mkZINqZtsGJMQFb0dj71d5U3PRTihX03qt2NWIfZic2CCcGXOHJ7A==",
+      "version": "1.4.322",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.322.tgz",
+      "integrity": "sha512-KovjizNC9XB7dno/2GjxX8VS0SlfPpCjtyoKft+bCO+UfD8bFy16hY4Sh9s0h9BDxbRH2U0zX5VBjpM1LTcNlg==",
       "dev": true
     },
     "node_modules/elliptic": {
@@ -3026,9 +3026,9 @@
       "dev": true
     },
     "caniuse-lite": {
-      "version": "1.0.30001460",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001460.tgz",
-      "integrity": "sha512-Bud7abqjvEjipUkpLs4D7gR0l8hBYBHoa+tGtKJHvT2AYzLp1z7EmVkUT4ERpVUfca8S2HGIVs883D8pUH1ZzQ==",
+      "version": "1.0.30001462",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001462.tgz",
+      "integrity": "sha512-PDd20WuOBPiasZ7KbFnmQRyuLE7cFXW2PVd7dmALzbkUXEP46upAuCDm9eY9vho8fgNMGmbAX92QBZHzcnWIqw==",
       "dev": true
     },
     "chrome-trace-event": {
@@ -3077,9 +3077,9 @@
       "integrity": "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ=="
     },
     "electron-to-chromium": {
-      "version": "1.4.321",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.321.tgz",
-      "integrity": "sha512-ERuAqNq7YknVY3+47VbB+Q92kWH7O7sX3mkZINqZtsGJMQFb0dj71d5U3PRTihX03qt2NWIfZic2CCcGXOHJ7A==",
+      "version": "1.4.322",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.322.tgz",
+      "integrity": "sha512-KovjizNC9XB7dno/2GjxX8VS0SlfPpCjtyoKft+bCO+UfD8bFy16hY4Sh9s0h9BDxbRH2U0zX5VBjpM1LTcNlg==",
       "dev": true
     },
     "elliptic": {