sops: harden binary install

sops/action.yml

@@ -22,12 +22,15 @@ runs:
         asset="sops-${SOPS_VERSION}.${os}.${arch}"
         url="https://github.com/getsops/sops/releases/download/${SOPS_VERSION}"
 
-        curl -fsSL -o "$asset" "${url}/${asset}" -o checksums.txt "${url}/sops-${SOPS_VERSION}.checksums.txt"
+        tmp=$(mktemp -d)
-        grep " ${asset}$" checksums.txt | shasum -a 256 -c -
+        trap 'rm -rf "$tmp"' EXIT
 
-        chmod +x "$asset"
+        curl -fsSL -o "$tmp/$asset" "$url/$asset" \
-        sudo mv "$asset" /usr/local/bin/sops
+          -o "$tmp/checksums.txt" "$url/sops-${SOPS_VERSION}.checksums.txt"
-        rm checksums.txt
+        (cd "$tmp" && grep " ${asset}$" checksums.txt | shasum -a 256 -c -)
+
+        chmod +x "$tmp/$asset"
+        sudo mv "$tmp/$asset" /usr/local/bin/sops
 
     - name: decrypt .sops files
       shell: bash
@@ -38,16 +41,20 @@ runs:
 
         echo "searching for SOPS files to decrypt..."
 
-        ## decrypt every *.sops.* file (except .sops.yaml)
         while IFS= read -r -d '' file; do
           dir=$(dirname "$file"); base=$(basename "$file")
           output_file="$dir/${base/.sops/}"
 
           echo "decrypting '$file' to '$output_file'"
 
-          tmp=$(mktemp)
+          tmp=$(mktemp "$dir/.sops-decrypt.XXXXXX")
-          sops --decrypt "$file" > "$tmp"
+
-          [ -s "$tmp" ] || { echo "decryption of '$file' produced empty output" >&2; exit 1; }
+          if ! sops --decrypt "$file" > "$tmp" || [ ! -s "$tmp" ]; then
+            echo "decryption of '$file' failed or produced empty output" >&2
+            rm -f "$tmp"
+            exit 1
+          fi
+
           chmod 600 "$tmp"
           mv "$tmp" "$output_file"
         done < <(find . -type f -name "*.sops.*" -not -name ".sops.yaml" -print0)