fix(ci): verify the KSail archive before installing it in the validate job #2841

🤖 Generated by the Agentic Engineer

Evidence

ci.yaml's ⚙️ Setup KSail step downloads the KSail release archive from a version-pinned URL, then extracts it and sudo installs it — with no integrity check:

curl -fsSL "https://github.com/devantler-tech/ksail/releases/download/v${KSAIL_VERSION}/ksail_${KSAIL_VERSION}_linux_amd64.tar.gz" -o /tmp/ksail.tar.gz
tar -xzf /tmp/ksail.tar.gz -C /tmp
sudo install /tmp/ksail /usr/local/bin/ksail

A version-pinned URL is not an integrity check: it names which asset to fetch, not what bytes to expect. A replaced release asset would be installed and executed by the workflow.

Raised by CodeRabbit against the identical step newly added in #2830, where it has been fixed. This issue covers the pre-existing instance in ci.yaml, deliberately left out of that PR so a supply-chain change does not ride along inside a PR about Kubescape SARIF publishing.

Affected audience and impact

Every pull_request and merge_group run of ci.yaml that hits the validate job. merge_group runs gate merges to main, so the binary runs on a trusted path.

Expected behaviour

The archive is verified before it is extracted or installed, and a verification that cannot be performed fails the step rather than being skipped.

Acceptance criteria

• The validate job verifies ksail_${KSAIL_VERSION}_linux_amd64.tar.gz against the release's published ksail_${KSAIL_VERSION}_checksums.txt before tar -xzf.
• A missing checksum entry fails the step with an actionable message — it must not silently skip verification. Note grep exits 1 under set -euo pipefail, so the lookup needs || true or the step dies before the message prints.
• A checksum mismatch fails the step and names the expected and actual digests.
• Verified three ways before merge: real archive passes, a tampered archive fails, a missing entry fails closed.

The implementation in #2830's validate-main.yaml kubescape-baseline job is a working reference — this is the same block.

Deliberately NOT a pinned literal SHA

KSAIL_VERSION is Renovate-managed (datasource=github-releases, group ksail). Renovate bumps the version but cannot update an opaque digest beside it, so a pinned SHA breaks CI on every bump until hand-edited — a control that reliably breaks the routine path is one that gets removed.

Stated limit: archive and checksum list share an origin, so this detects a corrupted, truncated or individually-substituted asset, not a fully compromised release.

Stronger follow-up (measured, not speculative)

KSail publishes an attestation for the exact asset digest, but it is an https://in-toto.io/attestation/release/v0.2 predicate and gh attestation verify returns no attestations found for it — with the default predicate and with that one passed explicitly. So attestation-based verification is not a drop-in today; it needs its own investigation.

Size

Small — one run: block, plus the three-way verification.