CKS Security Quest · Binary verification

Trust, then install

Verify provenance before a binary reaches a privileged path.

CKS-0114 minutes

Task

/opt/release/kubectl
/opt/release/kubectl.sha256

The checksum file contains a raw official SHA-256 value without a filename.

  1. Verify the binary.
  2. Install only on success as root:root and 0755.
  3. Show client version.
  4. Show installed owner and mode.