Merge branch 'maint'

Carries the four security fixes forward. Three resolutions were not mechanical, because this line has moved under them: The handshake reaper is async here too, so it can close the transport connection it used to forget. That meant porting the change onto the sans-IO refactor rather than taking maint's text: check_timeouts, cleanup_stale_connection and drive_handshake_timeouts all become async, and the call sites in the rx loop's instrumented tick body and in the supervisor's stale sweep gain their awaits. maint's lifecycle.rs no longer exists on this line; its call site is in lifecycle/mod.rs. The keygen guard keeps both changes: this line's note about keys stranded at the old macOS and FreeBSD default directory, and maint's switch from exists() to symlink_metadata() so a dangling symlink cannot slip past the overwrite refusal. The onion transport's first-frame deadline is NOT carried. maint reads its frames inline, while this line has moved Tor and Nym onto a shared proxied receive loop, so the fix would have to be implemented against that shared loop and would touch Nym with it. Doing that inside a merge resolution, on a security deadline, with no review, is the wrong place for it. The TCP half of the deadline is present and covers the listener that carries the 256-slot default; the onion listener with its 64-slot cap is left as filed follow-up work on this line and next. The test frame builder lives in transport::framing here rather than in transport::tcp::stream.
2026-08-12 01:27:32 +00:00 · 2026-08-11 15:56:49 +00:00
parent ba161eadb7 64aa314e26
commit 98c6cf6b62
20 changed files with 1691 additions and 209 deletions
@@ -0,0 +1,105 @@
+#!/bin/bash
+# ── Install nak, checksum-verified ──────────────────────────────────────────
+# nak signs the release announcement events, and the jobs that call this script
+# hand it the publishing nsec on argv. An unverified download therefore runs
+# with the signing key in reach, so the binary is staged, checked against a
+# pinned SHA-256, and only then installed.
+#
+# Called from .github/workflows/package-openwrt.yml by both the .ipk (`build`)
+# and .apk (`build-apk`) jobs, which is why it lives here rather than under
+# packaging/openwrt-ipk/ — that directory is the .ipk payload tree.
+#
+# Exit 0 = installed and verified. Any non-zero exit means nothing was
+# installed.
+# ─────────────────────────────────────────────────────────────────────────────
+set -euo pipefail
+
+NAK_VERSION="0.16.2"
+INSTALL_PATH="/usr/local/bin/nak"
+
+ARCH=$(uname -m)
+# Each arch carries the expected SHA-256 of its upstream release asset.
+#
+# Unlike the zig hashes in the same workflow, which come from ziglang.org's own
+# https://ziglang.org/download/index.json, these are NOT upstream-attested:
+# fiatjaf/nak publishes no checksum document, sidecar or SHA256SUMS alongside
+# its release assets, so the only way to obtain a hash is to download the asset
+# and compute it. These were derived that way on 2026-08-11 from
+#   https://github.com/fiatjaf/nak/releases/download/v0.16.2/nak-v0.16.2-linux-<arch>
+# What the pin buys is therefore continuity, not authenticity: it detects the
+# asset changing under a fixed tag, a corrupted or truncated transfer, and a
+# substituted download, but it cannot attest that the bytes captured on that
+# date were the bytes upstream intended. Bumping NAK_VERSION means re-deriving
+# every hash below, and adding an arch means adding its hash here too.
+case "$ARCH" in
+  x86_64|amd64)
+    NAK_ARCH="amd64"
+    NAK_SHA256="495243c070c4533ce96e98b6f34b7e97fd4be2da3353488b400233ed7ed0d4da"
+    ;;
+  aarch64|arm64)
+    NAK_ARCH="arm64"
+    NAK_SHA256="1fb8868c60ebf77dd86f90d6374ebf8557412baa37026d2844af932776085b88"
+    ;;
+  *)
+    echo "Unsupported architecture: $ARCH"
+    exit 1
+    ;;
+esac
+
+if [ -z "${NAK_SHA256:-}" ]; then
+  echo "No SHA-256 pinned for nak ${NAK_VERSION} on ${NAK_ARCH}."
+  echo "Add one to the case above, derived by downloading the asset:"
+  echo "  curl -fsSL <asset-url> | sha256sum"
+  exit 1
+fi
+
+NAME="nak-v${NAK_VERSION}-linux-${NAK_ARCH}"
+URL="https://github.com/fiatjaf/nak/releases/download/v${NAK_VERSION}/${NAME}"
+# Stage outside the checkout so a failed attempt cannot leave a stray binary in
+# the working tree, and so nothing lands at $INSTALL_PATH before it verifies.
+NAK_TMP="$(mktemp -d)"
+trap 'rm -rf "$NAK_TMP"' EXIT
+TMP="${NAK_TMP}/${NAME}"
+
+# Download to a file and check it before installing. curl's own --retry does
+# not cover a short read (exit 18), and a checksum mismatch needs a fresh
+# download anyway, so the retry is an explicit bounded loop — the same failure
+# mode that forced one on the zig step in this workflow.
+verified=""
+previous=""
+for attempt in 1 2 3; do
+  rm -f "$TMP"
+  if curl -fsSL -o "$TMP" "$URL" && [ -s "$TMP" ]; then
+    actual="$(sha256sum < "$TMP" | cut -d' ' -f1)"
+    if [ "$actual" = "$NAK_SHA256" ]; then
+      echo "nak binary matches its pinned SHA-256 (${actual})"
+      verified=yes
+      break
+    fi
+    echo "nak binary failed its checksum on attempt ${attempt}:"
+    echo "  expected ${NAK_SHA256}"
+    echo "  actual   ${actual}"
+    echo "  size     $(wc -c < "$TMP") bytes"
+    if [ "$actual" = "$previous" ]; then
+      echo "Two attempts fetched byte-identical content, so retrying is not"
+      echo "going to help: the pin is stale, upstream re-published, or the"
+      echo "source is serving the same bad file every time."
+      break
+    fi
+    previous="$actual"
+  else
+    echo "nak binary download failed on attempt ${attempt}"
+  fi
+  if [ "$attempt" -lt 3 ]; then
+    sleep $((attempt * 10))
+  fi
+done
+
+if [ -z "$verified" ]; then
+  echo "nak ${NAK_VERSION} (${NAK_ARCH}) did not download with its pinned"
+  echo "SHA-256 ${NAK_SHA256} in 3 attempts. Nothing installed at ${INSTALL_PATH}."
+  exit 1
+fi
+
+install -m 0755 "$TMP" "$INSTALL_PATH"
+echo "Installed nak ${NAK_VERSION} (${NAK_ARCH}) at ${INSTALL_PATH}"
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Patch PKGBUILD-git b2sums for local assets
        run: |
@@ -42,7 +42,7 @@ jobs:
          awk '/^b2sums=\(/,/\)$/' packaging/aur/PKGBUILD-git

      - name: Publish to AUR
-        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
+        uses: KSXGitHub/github-actions-deploy-aur@abe8ac26b51011c88be58c8809fd2ac674068ea5 # v4.1.2
        with:
          pkgname: fips-git
          pkgbuild: packaging/aur/PKGBUILD-git
@@ -41,7 +41,7 @@ jobs:
          set -euo pipefail
          pacman -Sy --noconfirm --needed base-devel namcap git curl

-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Resolve package version
        id: ver
@@ -176,7 +176,7 @@ jobs:
          echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
          echo "pkgrel=${PKGREL}" >> "$GITHUB_OUTPUT"

-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          ref: ${{ steps.tag.outputs.tag }}

@@ -188,7 +188,7 @@ jobs:
        run: bash packaging/aur/patch-pkgbuild.sh

      - name: Publish to AUR
-        uses: KSXGitHub/github-actions-deploy-aur@v4.1.2
+        uses: KSXGitHub/github-actions-deploy-aur@abe8ac26b51011c88be58c8809fd2ac674068ea5 # v4.1.2
        with:
          pkgname: fips
          pkgbuild: packaging/aur/PKGBUILD
@@ -56,7 +56,7 @@ jobs:
    name: CI parity
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - name: Install Python deps
        run: pip3 install --quiet pyyaml
      - name: Check local and GitHub runners cover the same work
@@ -67,6 +67,8 @@ jobs:
        run: python3 testing/check-trailing-log.py
      - name: Check nothing resolves the shared mutable test image
        run: bash testing/check-image-scoping.sh
+      - name: Check every action is pinned to a commit SHA
+        run: bash testing/check-action-pins.sh
      # Hermetic: synthetic ping functions, no containers, ~45s. Lives beside
      # the other two so both runners gate on it identically — putting it in
      # only one would create exactly the drift check-ci-parity.sh exists to
@@ -79,8 +81,8 @@ jobs:
    name: Format check
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          components: rustfmt
          cache: false
@@ -91,16 +93,16 @@ jobs:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
      - name: Install system dependencies
        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          components: clippy
          cache: false
          rustflags: ''
      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -178,7 +180,7 @@ jobs:
          - os: windows-latest

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set SOURCE_DATE_EPOCH from git (Unix)
        if: runner.os != 'Windows'
@@ -200,13 +202,13 @@ jobs:
        run: sudo nft -c -f packaging/common/fips.nft

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -235,7 +237,7 @@ jobs:
      # Upload the Linux binary so integration jobs can use it without rebuilding
      - name: Upload Linux binary
        if: matrix.os == 'ubuntu-latest'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fips-linux
          path: |
@@ -256,7 +258,7 @@ jobs:
    runs-on: ubuntu-latest
    needs: [build]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set SOURCE_DATE_EPOCH from git
        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"
@@ -265,13 +267,13 @@ jobs:
        run: sudo apt-get update && sudo apt-get install -y libdbus-1-dev

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -288,7 +290,7 @@ jobs:
        run: cargo nextest run --all --profile ci

      - name: Publish test report (Checks tab)
-        uses: dorny/test-reporter@v2
+        uses: dorny/test-reporter@df6247429542221bc30d46a036ee47af1102c451 # v2
        if: always()
        with:
          name: Unit Tests
@@ -297,7 +299,7 @@ jobs:
          fail-on-error: false

      - name: Publish test report (run summary)
-        uses: mikepenz/action-junit-report@v4
+        uses: mikepenz/action-junit-report@db71d41eb79864e25ab0337e395c352e84523afe # v4
        if: always()
        with:
          report_paths: target/nextest/ci/junit.xml
@@ -318,19 +320,19 @@ jobs:
    runs-on: macos-latest
    needs: [build]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Set SOURCE_DATE_EPOCH from git
        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -353,16 +355,16 @@ jobs:
    name: Unit tests (Windows)
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -391,7 +393,7 @@ jobs:
    name: PowerShell lint (Windows packaging)
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      - name: Run PSScriptAnalyzer
        shell: pwsh
@@ -520,11 +522,11 @@ jobs:
            type: dns-resolver

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6

      # Fetch the pre-built Linux binary from job 1
      - name: Download Linux binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: fips-linux
          path: _bin
@@ -596,7 +598,7 @@ jobs:

      - name: Upload sim results on failure (chaos)
        if: matrix.type == 'chaos' && failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: sim-results-${{ matrix.scenario }}
          path: testing/chaos/sim-results/
@@ -19,7 +19,7 @@ jobs:
    outputs:
      linux_package_version: ${{ steps.linux_version.outputs.linux_package_version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -61,7 +61,7 @@ jobs:
            deb_arch: arm64

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -72,14 +72,14 @@ jobs:
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libdbus-1-dev llvm

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
        if: ${{ env.ACT != 'true' }}
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -140,7 +140,7 @@ jobs:

      - name: Upload artifact (GitHub only)
        if: ${{ env.ACT != 'true' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fips_${{ needs.determine-versioning.outputs.linux_package_version }}_${{ matrix.artifact_arch }}_linux
          path: |
@@ -164,7 +164,7 @@ jobs:

    steps:
      - name: Download Linux artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true
@@ -19,7 +19,7 @@ jobs:
    outputs:
      macos_package_version: ${{ steps.macos_version.outputs.macos_package_version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -61,7 +61,7 @@ jobs:
            target: x86_64-apple-darwin

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -69,14 +69,14 @@ jobs:
        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          target: ${{ matrix.target }}
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -209,7 +209,7 @@ jobs:
          ( cd "$(dirname "$PKG")" && shasum -a 256 "$(basename "$PKG")" | tee "$(basename "$PKG").sha256" )

      - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fips_${{ needs.determine-versioning.outputs.macos_package_version }}_${{ matrix.arch }}_macos
          path: |
@@ -229,7 +229,7 @@ jobs:

    steps:
      - name: Download macOS artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true
@@ -283,7 +283,7 @@ jobs:

    steps:
      - name: Download macOS artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true
@@ -27,7 +27,7 @@ jobs:
      apk_version: ${{ steps.version.outputs.apk_version }}
      release_channel: ${{ steps.channel.outputs.release_channel }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -104,13 +104,13 @@ jobs:
            # x86 routers / VMs

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

      - name: Install Rust toolchain (stable)
        if: matrix.rust_channel == 'stable'
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          target: ${{ matrix.rust_target }}
          cache: false
@@ -124,7 +124,7 @@ jobs:

      - name: Cache Cargo registry + build
        if: ${{ env.ACT != 'true' }}
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -247,7 +247,7 @@ jobs:
          ls -lh out/

      - name: Upload binaries artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fips-bins-${{ matrix.openwrt_arch }}
          path: out/
@@ -270,7 +270,7 @@ jobs:
            openwrt_arch: x86_64

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -283,24 +283,17 @@ jobs:
          echo "PACKAGE_FILENAME=$PACKAGE_FILENAME" >> $GITHUB_ENV

      - name: Download prebuilt binaries
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: fips-bins-${{ matrix.openwrt_arch }}
          path: bins

+      # nak receives the signing nsec on argv further down, so the download is
+      # staged and checked against a pinned SHA-256 before it is installed.
      - name: Install nak
        shell: bash
        run: |
-          NAK_VERSION="0.16.2"
-          ARCH=$(uname -m)
-          case "$ARCH" in
-            x86_64|amd64) NAK_ARCH="amd64" ;;
-            aarch64|arm64) NAK_ARCH="arm64" ;;
-            *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
-          esac
-          curl -fsSL "https://github.com/fiatjaf/nak/releases/download/v${NAK_VERSION}/nak-v${NAK_VERSION}-linux-${NAK_ARCH}" \
-            -o /usr/local/bin/nak
-          chmod +x /usr/local/bin/nak
+          bash .github/scripts/install-nak.sh
          nak --version

      - name: Install jq
@@ -346,6 +339,13 @@ jobs:
          fi
          shellcheck --version

+      # Its own step, and its own shell dialect. The shipped-scripts lint below
+      # runs --shell=sh with the OpenWrt rc.common exclude set, which misfires
+      # on a bash script; install-nak.sh is also not shipped in the package.
+      - name: Lint install-nak.sh
+        shell: bash
+        run: shellcheck --shell=bash .github/scripts/install-nak.sh
+
      - name: Lint shipped shell scripts
        shell: bash
        run: |
@@ -533,7 +533,7 @@ jobs:

      - name: Upload artifact (GitHub only)
        if: ${{ env.ACT != 'true' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ env.PACKAGE_FILENAME }}
          path: dist/${{ env.PACKAGE_FILENAME }}
@@ -688,7 +688,7 @@ jobs:
      APK_TOOLS_COMMIT: "b5a31c0d865342ad80be10d68f1bb3d3ad9b0866"

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -701,7 +701,7 @@ jobs:
          echo "PACKAGE_FILENAME=$PACKAGE_FILENAME" >> $GITHUB_ENV

      - name: Download prebuilt binaries
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          name: fips-bins-${{ matrix.openwrt_arch }}
          path: bins
@@ -826,25 +826,18 @@ jobs:

      - name: Upload artifact (GitHub only)
        if: ${{ env.ACT != 'true' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: ${{ env.PACKAGE_FILENAME }}
          path: dist/${{ env.PACKAGE_FILENAME }}
          retention-days: 30

+      # nak receives the signing nsec on argv further down, so the download is
+      # staged and checked against a pinned SHA-256 before it is installed.
      - name: Install nak
        shell: bash
        run: |
-          NAK_VERSION="0.16.2"
-          ARCH=$(uname -m)
-          case "$ARCH" in
-            x86_64|amd64) NAK_ARCH="amd64" ;;
-            aarch64|arm64) NAK_ARCH="arm64" ;;
-            *) echo "Unsupported architecture: $ARCH"; exit 1 ;;
-          esac
-          curl -fsSL "https://github.com/fiatjaf/nak/releases/download/v${NAK_VERSION}/nak-v${NAK_VERSION}-linux-${NAK_ARCH}" \
-            -o /usr/local/bin/nak
-          chmod +x /usr/local/bin/nak
+          bash .github/scripts/install-nak.sh
          nak --version

      - name: Install jq
@@ -988,7 +981,7 @@ jobs:

    steps:
      - name: Download package artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          # Only the .ipk/.apk packages (named fips_<ver>_<arch>.*), not the
          # fips-bins-* raw-binary artifacts shared between the build jobs.
@@ -1005,7 +998,7 @@ jobs:
            > checksums-openwrt.txt

      - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
        with:
          files: |
            dist/*.ipk
@@ -19,7 +19,7 @@ jobs:
    outputs:
      package_version: ${{ steps.version.outputs.package_version }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -52,7 +52,7 @@ jobs:
    needs: determine-versioning

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          fetch-depth: 0

@@ -63,13 +63,13 @@ jobs:
          echo "SOURCE_DATE_EPOCH=$epoch" >> $env:GITHUB_ENV

      - name: Install Rust toolchain
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
        with:
          cache: false
          rustflags: ''

      - name: Cache Cargo registry + build
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        with:
          path: |
            ~/.cargo/registry
@@ -146,7 +146,7 @@ jobs:
          }

      - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fips_${{ needs.determine-versioning.outputs.package_version }}_x86_64_windows
          path: deploy/fips-*-windows-*.zip
@@ -170,7 +170,7 @@ jobs:

    steps:
      - name: Download Windows artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          path: dist
          merge-multiple: true