Repository: risingwavelabs/risingwave
File: ci/scripts/release.sh (Shell)

Code before:
ld.lld --version

echo "--- Install dependencies"
dnf install -y perl-core wget python3.12 python3.12-devel cyrus-sasl-devel rsync openssl-devel blas-devel lapack-devel libgomp
# python udf compiling requires python3.12
update-alternatives --install /usr/bin/python3 python3 /usr/local/bin/python3.12 3

echo "--- Install java and maven"
dnf install -y java-17-openjdk java-17-openjdk-devel
pipx install toml-cli
wget --no-verbose https://rw-ci-deps-dist.s3.amazonaws.com/apache-maven-3.9.3-bin.tar.gz && tar -zxvf apache-maven-3.9.3-bin.tar.gz
export PATH="${REPO_ROOT}/apache-maven-3.9.3/bin:$PATH"
mvn -v

echo "--- Install rust"
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- --no-modify-path --default-toolchain none -y
source "$HOME/.cargo/env"
rustup show
source ci/scripts/common.sh
unset RUSTC_WRAPPER # disable sccache
unset RUSTC_WORKSPACE_WRAPPER

echo "--- Install protoc3"
PROTOC_ARCH=${ARCH}
if [ "${ARCH}" == "aarch64" ]; then
  # shellcheck disable=SC1068
  PROTOC_ARCH="aarch_64"
fi
curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.8/protoc-3.15.8-linux-"${PROTOC_ARCH}".zip
unzip -o protoc-3.15.8-linux-"${PROTOC_ARCH}".zip -d protoc
mv ./protoc/bin/protoc /usr/local/bin/
mv ./protoc/include/* /usr/local/include/

echo "--- Install nodejs"
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
export NVM_DIR="$HOME/.nvm"
. "$NVM_DIR/nvm.sh"
cd dashboard && nvm install && nvm use && cd ..

echo "--- Check risingwave release version"
if [[ -n "${BUILDKITE_TAG}" ]]; then
  CARGO_PKG_VERSION="$(toml get --toml-path Cargo.toml workspace.package.version)"
  if [[ "${CARGO_PKG_VERSION}" != "${BUILDKITE_TAG#*v}" ]]; then
    echo "CARGO_PKG_VERSION: ${CARGO_PKG_VERSION}"
    echo "BUILDKITE_TAG: ${BUILDKITE_TAG}"
    echo "CARGO_PKG_VERSION and BUILDKITE_TAG are not equal"
    exit 1
  fi
fi

echo "--- Build risingwave release binary"

Review comment (security):
The new `curl ... | bash` installation of `cargo-binstall` pulls and executes a third-party script from `raw.githubusercontent.com/cargo-bins/cargo-binstall/main/...` without any integrity pinning or verification, creating a supply-chain risk in the release pipeline. If that GitHub repository or the network path is compromised, an attacker could run arbitrary code in CI, exfiltrate release secrets, or tamper with the built artifacts. Prefer using a pinned, integrity-checked distribution method (e.g., pinned commit/asset with checksum/signature verification) instead of executing a mutable `main`-branch script directly.

Code after:
unzip -q awscliv2.zip && ./aws/install && mv /usr/local/bin/aws /bin/aws

echo "--- Install lld"
dnf install -y lld
ld.lld --version

echo "--- Install dependencies"
dnf install -y perl-core wget python3.12 python3.12-devel cyrus-sasl-devel rsync openssl-devel blas-devel lapack-devel libgomp
# python udf compiling requires python3.12
update-alternatives --install /usr/bin/python3 python3 /usr/local/bin/python3.12 3

echo "--- Install java and maven"
dnf install -y java-17-openjdk java-17-openjdk-devel
pipx install toml-cli
wget --no-verbose https://rw-ci-deps-dist.s3.amazonaws.com/apache-maven-3.9.3-bin.tar.gz && tar -zxvf apache-maven-3.9.3-bin.tar.gz
export PATH="${REPO_ROOT}/apache-maven-3.9.3/bin:$PATH"
mvn -v

echo "--- Install rust"
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- --no-modify-path --default-toolchain none -y
source "$HOME/.cargo/env"
rustup show

echo "--- Install sccache"
curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
cargo binstall -y --locked sccache@0.10.0

echo "--- Install protoc3"
PROTOC_ARCH=${ARCH}
if [ "${ARCH}" == "aarch64" ]; then
  # shellcheck disable=SC1068
  PROTOC_ARCH="aarch_64"
fi
curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v3.15.8/protoc-3.15.8-linux-"${PROTOC_ARCH}".zip
unzip -o protoc-3.15.8-linux-"${PROTOC_ARCH}".zip -d protoc
mv ./protoc/bin/protoc /usr/local/bin/
mv ./protoc/include/* /usr/local/include/

echo "--- Install nodejs"
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
export NVM_DIR="$HOME/.nvm"
. "$NVM_DIR/nvm.sh"
cd dashboard && nvm install && nvm use && cd ..

echo "--- Check risingwave release version"
if [[ -n "${BUILDKITE_TAG}" ]]; then
  CARGO_PKG_VERSION="$(toml get --toml-path Cargo.toml workspace.package.version)"
  if [[ "${CARGO_PKG_VERSION}" != "${BUILDKITE_TAG#*v}" ]]; then
    echo "CARGO_PKG_VERSION: ${CARGO_PKG_VERSION}"
    echo "BUILDKITE_TAG: ${BUILDKITE_TAG}"
    echo "CARGO_PKG_VERSION and BUILDKITE_TAG are not equal"