sh4d0wup 0.11.0

Signing-key abuse and update exploitation framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

name: Docker Image CI

on:
  push:
    branches: [ "main" ]
    tags: [ "v*.*.*" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
    - uses: actions/checkout@v4
    - uses: docker/setup-buildx-action@v3

    - name: Build Docker image (full)
      uses: docker/build-push-action@v6
      with:
        tags: sh4d0wup:full
        target: full
        load: true
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Build Docker image (default)
      uses: docker/build-push-action@v6
      with:
        tags: sh4d0wup:default
        target: default
        load: true
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Build Docker image (smol)
      uses: docker/build-push-action@v6
      with:
        tags: sh4d0wup:smol
        target: smol
        load: true
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Test the Docker images
      run: |
        docker run --rm sh4d0wup:smol --help
        docker run --rm sh4d0wup:default --help
        docker run --rm sh4d0wup:full --help

    - name: Login to github container registry
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Push the image to `edge`
      if: github.event_name == 'push' && github.ref_name == 'main'
      run: |
        docker tag sh4d0wup:smol ghcr.io/${{ github.repository }}:edge-smol
        docker tag sh4d0wup:default ghcr.io/${{ github.repository }}:edge
        docker tag sh4d0wup:full ghcr.io/${{ github.repository }}:edge-full
        docker push ghcr.io/${{ github.repository }}:edge-smol
        docker push ghcr.io/${{ github.repository }}:edge-full
        docker push ghcr.io/${{ github.repository }}:edge

    - name: Push the image to `${{ github.ref_name }}`
      if: github.ref_type == 'tag'
      run: |
        docker tag sh4d0wup:smol ghcr.io/${{ github.repository }}:${{ github.ref_name }}-smol
        docker tag sh4d0wup:default ghcr.io/${{ github.repository }}:${{ github.ref_name }}
        docker tag sh4d0wup:full ghcr.io/${{ github.repository }}:${{ github.ref_name }}-full
        docker push ghcr.io/${{ github.repository }}:${{ github.ref_name }}-smol
        docker push ghcr.io/${{ github.repository }}:${{ github.ref_name }}-full
        docker push ghcr.io/${{ github.repository }}:${{ github.ref_name }}

    - name: Push the image to `latest`
      if: github.ref_type == 'tag'
      run: |
        docker tag sh4d0wup:smol ghcr.io/${{ github.repository }}:smol
        docker tag sh4d0wup:default ghcr.io/${{ github.repository }}:latest
        docker tag sh4d0wup:full ghcr.io/${{ github.repository }}:full
        docker push ghcr.io/${{ github.repository }}:smol
        docker push ghcr.io/${{ github.repository }}:full
        docker push ghcr.io/${{ github.repository }}:latest

    - name: Export docker image to tar
      run: docker save sh4d0wup | zstd -T0 -10 > sh4d0wup.tar.zst

    - name: Upload as github artifact
      uses: actions/upload-artifact@v4
      with:
        name: container
        path: sh4d0wup.tar.zst

  make-plots:
    needs: build
    strategy:
      fail-fast: false
      matrix:
        variant:
          - img: sh4d0wup:smol
            excluded: |
              plot-elf-galore
              plot-rustup
              plot-terraform
          - img: sh4d0wup:default
            excluded: |
              plot-elf-galore
          - img: sh4d0wup:full

    name: ${{ matrix.variant.img }}
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: container
      - name: Import docker image
        run: zstd -cd sh4d0wup.tar.zst | docker load
      - name: Setup config for excluded tests
        run: |
          mkdir -vp build
          echo "${{ matrix.variant.excluded }}" | xargs -r -I{} touch build/{}.tar.zst
      - name: Compile all plots
        run: make -j8 sh4d0wup='docker run --rm -v "$$PWD":/mnt -w /mnt ${{ matrix.variant.img }}'