# Pinned third-party tool downloads used by the shared CI. Sourced by scripts. # The checksums were read from the upstream release over HTTPS (same origin as # the binary, so trust-on-first-use): cross-check them against an independent # source before the first publish. A tool without a checksum fails closed. NODE_VERSION=22.20.0 NODE_LINUX_X64_SHA256=eeaccb0378b79406f2208e8b37a62479c70595e20be6b659125eb77dd1ab2a29 # Node 24 for the plain node profile (node-version: 24): official linux-x64 tarball, installed by install-tool.sh node24 into a job temp dir. NODE24_VERSION=24.22.2 NODE24_LINUX_X64_SHA256=361718c444e49af2ca5a110c83ba6a8901143f23ab285ebbef0341f391f482a9 # Manifest rendering. kubectl v1.36.1 embeds Kustomize v5.8.1 (`kubectl kustomize`); no cluster is contacted. # Both checksums were fetched from the vendor (dl.k8s.io kubectl.sha256, get.helm.sh .sha256sum) and # re-verified against the downloaded bytes on 2026-11-01. Helm is installed only when a caller declares # enable-helm; it is unqualified (no current root uses helmCharts). KUBECTL_VERSION=1.36.1 KUBECTL_LINUX_X64_SHA256=629d3f410e09bf49b64ae7079f7f0bda1191efed311f7d37fdbab0ad5b0ec2b7 HELM_VERSION=4.3.1 HELM_LINUX_X64_SHA256=0403a88ae20913d11b10a2467b50087721fea7581736da6b9d3992f5357fe54b # Authentik blueprint lint (central linter). PyYAML is installed from this pinned sdist, never by pip. # PYYAML_SDIST_SHA256 is intentionally EMPTY: it could not be fetched offline and must not be invented, so # install-tool.sh pyyaml fails closed ("no pinned checksum") and blueprint-lint cannot be enabled until it is # filled from https://pypi.org/pypi/PyYAML/6.0.2/json (urls[].digests.sha256 of the sdist) and cross-checked. PYYAML_VERSION=6.0.2 PYYAML_SDIST_SHA256=d584d9ec91ad65861cc08d42e834324ef890a082e591037abe114850ff7bbc3e # Report-only analysis tools (versions from the orb scripts; semgrep was unpinned there). SEMGREP_VERSION=1.183.0 OWASP_DEPENDENCY_CHECK_VERSION=12.1.0 CYCLONEDX_VERSION=2.9.1 GITLEAKS_VERSION=8.21.2 GITLEAKS_LINUX_X64_SHA256=5bc41815076e6ed6ef8fbecc9d9b75bcae31f39029ceb55da08086315316e3ba # Image vulnerability scan + SBOM (image-build). Same release and checksum as the qualified nuncio-container path; # the checksum is pinned here, so the download fails closed on any mismatch. TRIVY_VERSION=0.76.1 TRIVY_LINUX_X64_SHA256=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0 # Linux language profiles (go, python, nix). Versions and checksums were read from the vendors over HTTPS on # 2026-11-01 (golangci-lint release checksums file, PyPI JSON, Docker Hub tag listing, Go module proxy): same # trust-on-first-use caveat as above, cross-check independently before the first live use. # golangci-lint is a checksum-verified binary. go-test-coverage runs through `go run @v`, so the Go # module proxy and checksum database verify it. ruff is installed from PyPI by exact version (no hash pin: wheels are # platform specific), into a throw-away venv. NIX_IMAGE_VERSION is the nixos/nix tag the nix profiles run in. GOLANGCI_LINT_VERSION=2.15.0 GOLANGCI_LINT_LINUX_X64_SHA256=9b7fe6a6bf6334b98decf8d86b11415ea7889afdabdd1959fdce23af2a9ebcea GO_TEST_COVERAGE_VERSION=2.18.8 RUFF_VERSION=0.17.3 NIX_IMAGE_VERSION=2.35.4 # actionlint for the optional legacy source gate (source-config actionlint=true). Official rhysd/actionlint v1.7.7 linux-amd64 release # archive, the same program version the original `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.7` gate ran. The checksum was # computed from the downloaded archive bytes on 2026-11-01 and matches the release's actionlint_1.7.7_checksums.txt. ACTIONLINT_VERSION=1.7.7 ACTIONLINT_LINUX_X64_SHA256=023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757 # Git LFS for the native macOS runner (swift-verify). Official git-lfs/git-lfs release v3.7.1, darwin-arm64 zip. The checksum is the # vendor's own line from the release asset sha256sums.asc (PGP-signed by the project), and was re-verified against the downloaded zip on # 2026-11-01. install-tool.sh git-lfs installs it only into a caller-supplied job temp directory, on Darwin arm64 only. GIT_LFS_VERSION=3.7.1 GIT_LFS_DARWIN_ARM64_SHA256=76260fb34f4ee622ff0a66b857e5954aa49c7e343a92e57a1ec4a760618c94b2 # Exact .NET SDKs for dotnet exact-sdk: SHA-512 from Microsoft's official release metadata (releases.json), verified against a download. DOTNET_SDK_10_0_401_WIN_X64_SHA512=24b670ad3d923bfcf47df6c3b034152398b42f6dbc388e10d783aee1cfb5e5817d399fc0ae2a12cfa822a55e61d34830ccb15c50ef6efee437ab874bb7c79430 # Nonroot writable-store runtime qualified for the existing Nix CI jobs. NIX_RUNTIME_IMAGE=git.kof22.com/koftwentytwo/ci-nix-runtime@sha256:3b62443b4df1c9e73827a20307b9900159eebb005901e8510b0bf9e12a2d55e1 # SwiftLint for the swift `make` mode (kof22-post `make lint`). The portable macOS zip; the version and checksum are the # ones the repository's original ci.yml pinned. Installed into a job temp directory only, never onto the host. SWIFTLINT_VERSION=0.65.1 SWIFTLINT_DARWIN_SHA256=c1e429b0599cf1b516f369a2d9ec04eaf0e436f3c12b637df8851fa52ff694d0 # Browser toolchain images (immutable). JAVA_BROWSER_IMAGE is the operator-preloaded content tag of the verified OCI # manifest (images/java-browser); once that exact archive is pushed to the private forge, replace it with # git.kof22.com//@sha256:. PLAYWRIGHT_IMAGE is the public digest to mirror there. JAVA_BROWSER_IMAGE=local/java-browser:298bba0a82d7b62237dbcd15e6c876c4d4bb68a575ee6f47dedeeb5591f5e7f0 PLAYWRIGHT_IMAGE=mcr.microsoft.com/playwright@sha256:06a9939e57531807f8d5fd76ce44b53165ffb7d7501d87ab10e285c20b1e971f NODE_IMAGE=node:22.20.0-bookworm@sha256:915acd9e9b885ead0c620e27e37c81b74c226e0e1c8177f37a60217b6eabb0d7 # Existing release packaging, run unpublished. GORELEASER_VERSION is the version license-tool's release.yml pinned; it runs # through `go run github.com/goreleaser/goreleaser/v2@v` (module proxy + checksum database verify it), only with # --snapshot, so nothing is published. CARGO_AUDIT_VERSION is the crates.io release current on 2026-11-01 (kfmtbox's legacy # job installed it unpinned); `cargo install --locked --version` is verified by the crates.io index checksums. GORELEASER_VERSION=2.16.0 # Tag release builds run the official prebuilt Linux amd64 binary (what the old goreleaser-action ran), not `go run`: compiling v2.16.0 from # source fails on grpc@v1.80.0 (undefined http2.TrailerPrefix). The checksum is the release's own checksums.txt line for goreleaser_Linux_x86_64.tar.gz. GORELEASER_LINUX_X64_SHA256=eaae05b5eba07533bd0f06846b68c808399504784df00c62eb219541fc04e5e2 CARGO_AUDIT_VERSION=0.22.2 # CARGO_DENY_VERSION (notion-sql's cargo-deny-action ran the floating latest) is the crates.io release current on 2026-11-01; # CARGO_DIST_VERSION is the cargo-dist-version notion-sql's Cargo.toml declares (crates.io 0.32.0, not yanked, binary `dist`). # Both install with `cargo install --locked --version`, so no archive checksum is pinned or invented. CARGO_DENY_VERSION=0.20.2 CARGO_DIST_VERSION=0.32.0 # Job-local Go for the native Windows branch build when the service account has no Go on PATH (build-artifacts.ps1 go-branch). # license-tool's legacy CI used Go 1.26. The zip and checksum are the go.dev/dl entry (https://go.dev/dl/?mode=json&include=all, # file go1.26.2.windows-amd64.zip, kind archive) read on 2026-11-01; the zip is verified before it is extracted. GO_WINDOWS_VERSION=1.26.2 GO_WINDOWS_AMD64_SHA256=98eb3570bade15cb826b0909338df6cc6d2cf590bc39c471142002db3832b708 # Job-local rustup for the native Windows rust-release build when the service account has no rustup on PATH (build-artifacts.ps1). # The checksum is the rustup project's own file https://static.rust-lang.org/rustup/archive/1.29.2/x86_64-pc-windows-msvc/rustup-init.exe.sha256 # (read 2026-11-01); the downloaded rustup-init.exe hashed to the same value and is verified again before it is run. RUSTUP_WINDOWS_VERSION=1.29.2 RUSTUP_WINDOWS_AMD64_SHA256=00f139da614dced87d3c3d4121c43eebdac3c1bf8a5ee86b9d80dfd71c8d70fd # Job-local MinGW-w64 for the declared x86_64-pc-windows-gnu release target when gcc.exe and dlltool.exe are not on PATH # (build-artifacts.ps1). WinLibs (Brecht Sanders, listed on mingw-w64.org) release 16.2.0posix-23.1.3-14.0.0-ucrt-r3, the x86_64 posix-seh # UCRT zip without LLVM: GCC 16.2.0, Binutils 2.47 (gcc.exe, dlltool.exe, ld.exe, as.exe), MinGW-w64 14.0.0. The checksum is the maintainer's # own .sha256 asset; GitHub's independently computed release asset digest and the downloaded bytes gave the same value on 2026-11-01. MINGW_WINDOWS_RELEASE=16.2.0posix-23.1.3-14.0.0-ucrt-r3 MINGW_WINDOWS_AMD64_ZIP=winlibs-x86_64-posix-seh-gcc-16.2.0-mingw-w64ucrt-14.0.0-r3.zip MINGW_WINDOWS_AMD64_SHA256=3c69305081e4a647144339a936244fcf7d3d9e558319e1ad7be2cd2886d4b6a1 # Optional source checks (source-verify checks=...): the tools the old orb CI jobs needed, installed only into a job temp dir. # yq is the version the old Munitor test job pinned (v4.44.6): the official linux_amd64 binary; the checksum matches the SHA-256 column of the # release's `checksums` file. Bats is the old job's v1.11.1 tag (GitHub tag archive; run in place, no install.sh); the checksum was computed from the # downloaded archive on 2026-11-02 (trust on first use). ShellCheck 0.8.0 is the official linux.x86_64 release (Ubuntu 22.04's package version, the # one the old `apt-get install shellcheck` step is believed to have resolved on cimg/node:22.12; NOT proven, so no parity claim; the checksum was # computed from the downloaded archive on 2026-11-02, trust on first use). envsubst is the Ubuntu jammy gettext-base .deb extracted with # dpkg-deb into the temp dir (the old step apt-installed gettext-base); the checksum is the SHA256 of the jammy Packages index and matches the download. YQ_VERSION=4.44.6 YQ_LINUX_X64_SHA256=0c2b24e645b57d8e7c0566d18643a6d4f5580feeea3878127354a46f2a1e4598 # jq for the make-bats check: Munitor's public allocate_version test calls jq against a mock GitHub API, and the job image (node:22.20.0-bookworm) # has no jq. Official jqlang 1.8.1 linux-amd64 binary; the checksum is the release's own sha256sum.txt line and matches the downloaded bytes. JQ_VERSION=1.8.1 JQ_LINUX_X64_SHA256=020468de7539ce70ef1bceaf7cde2e8c4f2ca6c3afb84642aabc5c97d9fc2a0d BATS_VERSION=1.11.1 BATS_SHA256=5c57ed9616b78f7fd8c553b9bae3c7c9870119edd727ec17dbd1185c599f79d9 SHELLCHECK_VERSION=0.8.0 SHELLCHECK_LINUX_X64_SHA256=ab6ee1b178f014d1b86d1e24da20d1139656c8b0ed34d2867fbb834dad02bf0a GETTEXT_BASE_DEB=gettext-base_0.21-4ubuntu4_amd64.deb GETTEXT_BASE_DEB_SHA256=9a4971de9bd0ab746cfa7c018d88854da45bcc32dfb654ef9280b90b4445b3f3