From 547d60c64290000488de2273beab3b7d3379951e Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Wed, 22 Apr 2026 21:25:22 -0700
Subject: [PATCH] [Infra] CCI: match Windows uv install path to Linux
 verification pattern
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Windows uv install step was piping a remote install.ps1 into
Invoke-Expression without any integrity check, while the Linux
install steps (install_uv command, line 89) download to a file,
verify SHA-256 against a hardcoded digest, and only then execute.
Bring the Windows path to the same pattern.

Also hardcode the kubectl v1.31.4 checksum in helm_chart_testing
instead of fetching kubectl.sha256 from the same origin as the
binary — if dl.k8s.io were ever to serve a tampered pair, a
co-hosted checksum provides no additional integrity.
---
 .circleci/config.yml | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 6a3c5e3aa1..0ad8841e26 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -146,7 +146,15 @@ jobs:
       - run:
           name: Install Dependencies
           command: |
-            Invoke-RestMethod https://astral.sh/uv/0.10.9/install.ps1 | Invoke-Expression
+            $installer = Join-Path $env:TEMP "uv-install.ps1"
+            Invoke-WebRequest -Uri https://astral.sh/uv/0.10.9/install.ps1 -OutFile $installer
+            $expected = "d43ffff8d28e7d1e7d1831a212465f12b24a43c7f87f386e95e2a5915aee5d7d"
+            $actual = (Get-FileHash -Path $installer -Algorithm SHA256).Hash.ToLower()
+            if ($actual -ne $expected) {
+              throw "uv installer hash mismatch: expected $expected got $actual"
+            }
+            & $installer
+            Remove-Item $installer
             $uvBin = Join-Path $HOME ".local\bin"
             $env:Path = "$uvBin;$env:Path"
             if (!(Test-Path $PROFILE)) {
@@ -1165,18 +1173,15 @@ jobs:
       - install_helm
       - install_kind
 
-      # Install kubectl (pinned version with official checksum verification)
+      # Install kubectl (pinned version with hardcoded checksum)
       - run:
           name: Install kubectl v1.31.4
           command: |
             curl -sSLf -o /tmp/kubectl \
               https://dl.k8s.io/release/v1.31.4/bin/linux/amd64/kubectl
-            curl -sSLf -o /tmp/kubectl.sha256 \
-              https://dl.k8s.io/release/v1.31.4/bin/linux/amd64/kubectl.sha256
-            echo "$(cat /tmp/kubectl.sha256)  /tmp/kubectl" | sha256sum -c -
+            echo "298e19e9c6c17199011404278f0ff8168a7eca4217edad9097af577023a5620f  /tmp/kubectl" | sha256sum -c -
             chmod +x /tmp/kubectl
             sudo mv /tmp/kubectl /usr/local/bin/
-            rm -f /tmp/kubectl.sha256
 
       # Create kind cluster
       - run: