Rules / GL020

GL020 Downloaded file without checksum verification

Severity: warn
OWASP: CICD-SEC-9 – Improper Artifact Integrity Validation

What glsec checks

glsec flags jobs that download a file with curl or wget (saving to disk) but do not verify its integrity before using it. An attacker who compromises the download source — or performs a man-in-the-middle attack — can replace the file with malicious content that will execute with full pipeline privileges.

This rule complements GL011 (download-and-execute): GL011 catches the immediate curl | bash pattern, GL020 catches the subtler two-step variant where the file is saved first and verified later (or not at all).

A job is flagged when:

1. Any script/before_script/after_script line, or any run: step script, downloads to disk via curl -o, curl -O, curl --output, curl -sSLO, or wget
2. No checksum/signature verification command (sha256sum, shasum, md5sum, gpg --verify, cosign verify, openssl dgst) appears anywhere in the job's script

Trigger example

install:
  script:
    - curl -sSLO https://example.com/tool.tar.gz
    - tar xzf tool.tar.gz
    - ./tool install  # no integrity check performed

Safe alternatives

Checksum file:

install:
  script:
    - curl -sSLO https://example.com/tool.tar.gz
    - echo "a3b4c5d6…  tool.tar.gz" | sha256sum -c
    - tar xzf tool.tar.gz
    - ./tool install

GPG signature:

install:
  script:
    - curl -sSLO https://example.com/tool.tar.gz
    - curl -sSLO https://example.com/tool.tar.gz.sig
    - gpg --verify tool.tar.gz.sig tool.tar.gz
    - tar xzf tool.tar.gz

cosign (for OCI artefacts):

install:
  script:
    - curl -sSLO https://example.com/tool.tar.gz
    - cosign verify tool.tar.gz
    - tar xzf tool.tar.gz

Notes

• One finding is emitted per job, pointing to the first unverified download line.
• If checksum verification appears in before_script, it counts — the check considers all script sources in the job together, including run: steps.
• For the immediate curl | bash pattern, see GL011.

Documentation for glsec 1.23.0. Source of this page · Rule implementation