Make Dockerfile.test more secure

Signed-off-by: Manuel Buil <mbuil@suse.com>

Author: manuelbuil

Dockerfile.test

@@ -1,4 +1,9 @@
 ARG GOLANG=golang:1.25.7-alpine3.23
+ARG KUBECTL_VERSION=v1.34.6
+ARG BENTO_BOX_VERSION=202404.26.0
+ARG BENTO_BOX_SHA256=b23d416e559faab6d6de574b702388b8c998806c3e70c0d8175fddfb649eadb8
+ARG KUBECTL_SHA256=3166155b17198c0af34ff5a360bd4d9d58db98bafadc6f3c2a57ae560563cd6
+
 FROM ${GOLANG} AS test-base
 
 RUN apk -U --no-cache add bash jq
@@ -13,19 +18,25 @@ COPY ./scripts/test-mods /bin/
 ENTRYPOINT ["/bin/test-mods"]
 
 FROM test-base AS test-k3s
-
+ARG KUBECTL_VERSION
+ARG KUBECTL_SHA256
 RUN apk -U --no-cache add git gcc musl-dev docker curl coreutils openssl procps findutils yq
 
 ENV SONOBUOY_VERSION=0.57.2
 
 RUN OS=linux; \
     ARCH=$(go env GOARCH); \
-    RELEASE=$(curl -fs https://storage.googleapis.com/kubernetes-release/release/stable.txt); \
+    RELEASE=${KUBECTL_VERSION}; \
     if [ "${ARCH}" == "amd64" ] || [ "${ARCH}" == "arm64" ] || [ "${ARCH}" == "s390x" ]; then \
-      curl -sL "https://github.com/vmware-tanzu/sonobuoy/releases/download/v${SONOBUOY_VERSION}/sonobuoy_${SONOBUOY_VERSION}_${OS}_${ARCH}.tar.gz" | \
-      tar -xzf - -C /usr/local/bin; \
+      TARBALL="sonobuoy_${SONOBUOY_VERSION}_${OS}_${ARCH}.tar.gz"; \
+      curl -fsSL "https://github.com/vmware-tanzu/sonobuoy/releases/download/v${SONOBUOY_VERSION}/sonobuoy_${SONOBUOY_VERSION}_checksums.txt" -o /tmp/sonobuoy_checksums.txt; \
+      curl -fsSL "https://github.com/vmware-tanzu/sonobuoy/releases/download/v${SONOBUOY_VERSION}/${TARBALL}" -o /tmp/sonobuoy.tar.gz; \
+      echo "$(grep "${TARBALL}" /tmp/sonobuoy_checksums.txt | awk '{print $1}')  /tmp/sonobuoy.tar.gz" | sha256sum -c -; \
+      tar -xzf /tmp/sonobuoy.tar.gz -C /usr/local/bin; \
+      rm -f /tmp/sonobuoy.tar.gz /tmp/sonobuoy_checksums.txt; \
     fi; \
-    curl -fsL https://storage.googleapis.com/kubernetes-release/release/${RELEASE}/bin/linux/${ARCH}/kubectl -o /usr/local/bin/kubectl; \
+    curl -fsSL https://dl.k8s.io/release/${RELEASE}/bin/linux/${ARCH}/kubectl -o /usr/local/bin/kubectl; \
+    echo "${KUBECTL_SHA256}  /usr/local/bin/kubectl" | sha256sum -c -; \
     chmod a+x /usr/local/bin/kubectl; 
 
 ENV TEST_CLEANUP=true
@@ -35,22 +46,34 @@ CMD ["test"]
 
 
 FROM vagrantlibvirt/vagrant-libvirt:sha-a94ce0d AS test-e2e
+ARG KUBECTL_VERSION
+ARG BENTO_BOX_VERSION
+ARG BENTO_BOX_SHA256
+ARG KUBECTL_SHA256
 RUN apt-get update && apt-get install -y docker.io wget
 
 ENV VAGRANT_DISABLE_STRICT_DEPENDENCY_ENFORCEMENT=1
 RUN vagrant plugin install vagrant-k3s --plugin-version 0.4.0
 RUN vagrant plugin install vagrant-reload vagrant-scp
 
-# Workaround for older vagrant-libvirt image and new vagrant infra wesbites
+# Workaround for older vagrant-libvirt image and new vagrant infra websites
 # See https://github.com/hashicorp/vagrant/issues/13571 and
 # https://github.com/vagrant-libvirt/vagrant-libvirt/issues/1840
-RUN wget https://app.vagrantup.com/bento/boxes/ubuntu-24.04/versions/202404.26.0/providers/libvirt.box -O bento-ubuntu24.04-202404.26.0.box
-RUN vagrant box add bento/ubuntu-24.04 bento-ubuntu24.04-202404.26.0.box
-RUN cd /.vagrant.d/boxes/bento-VAGRANTSLASH-ubuntu-24.04/ && mv 0 202404.26.0 && echo -n "https://app.vagrantup.com/bento/boxes/ubuntu-24.04" > metadata_url
-
-RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"; \
+RUN wget --https-only --retry-connrefused --tries=3 \
+      "https://vagrantcloud.com/bento/boxes/ubuntu-24.04/versions/${BENTO_BOX_VERSION}/providers/libvirt/amd64/vagrant.box" \
+      -O "bento-ubuntu24.04-${BENTO_BOX_VERSION}.box" \
+    && if [ -n "${BENTO_BOX_SHA256}" ]; then \
+         echo "${BENTO_BOX_SHA256}  bento-ubuntu24.04-${BENTO_BOX_VERSION}.box" | sha256sum -c -; \
+       fi
+RUN vagrant box add bento/ubuntu-24.04 "bento-ubuntu24.04-${BENTO_BOX_VERSION}.box"
+RUN cd /.vagrant.d/boxes/bento-VAGRANTSLASH-ubuntu-24.04/ && mv 0 "${BENTO_BOX_VERSION}" \
+    && echo -n "https://app.vagrantup.com/bento/boxes/ubuntu-24.04" > metadata_url
+
+RUN RELEASE=${KUBECTL_VERSION}; \
+    curl -fsSLo ./kubectl "https://dl.k8s.io/release/${RELEASE}/bin/linux/amd64/kubectl"; \
+    echo "${KUBECTL_SHA256}  ./kubectl" | sha256sum -c -; \
     chmod +x ./kubectl; \
-    mv ./kubectl /usr/local/bin/kubectl
+    mv ./kubectl /usr/local/bin/kubectl;
 RUN GO_VERSION=go1.23.6; \
     curl -O -L "https://golang.org/dl/${GO_VERSION}.linux-amd64.tar.gz"; \
     rm -rf /usr/local/go; \