Commits on May 3, 2021

1. Validate codecov uploader before executing. …

   After the recent Codecov security incident[1] I've been reviewing
   codecov usage across ROS repositories.
   
   This script is fetching the codecov bash uploader and env scripts
   without performing the recommended validation step.
   
   The validation step does not appear to have been widely explained or
   publicised and even the official codecov GitHub action was not
   validating the script until the recent security incident.
   
   I have made an attempt to validate the bash uploader here.
   The environment script is also used but early enough in the process that
   it wasn't convenient to validate with my lack of familiarity in the
   travis scripting style.
   
   If there's interest I can probably refactor this to fetch and validate
   both scripts during the setup phase instead of trying to do the bash
   uploader inline. However I wanted to start with a minimal change.
   
   [1]: https://about.codecov.io/security-update/

   

   nuclearsandwich committed May 3, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 55be2f4
   • Browse repository at this point

   Copy the full SHA

   55be2f4 View commit details

   Browse the repository at this point in the history