From 1f206a560bedf0d7971e9db5e475c37ec311acda Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Thu, 15 Apr 2021 21:41:42 +0200
Subject: [PATCH] ci: check sha512 of downloaded codecov script

---
 .circleci/config.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 43d91a3cc..31939c597 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -176,7 +176,13 @@ jobs:
           when: on_fail
       - run:
           name: Upload coverage to codecov
-          command: bash <(curl -s https://codecov.io/bash) -f coverage/codecov.json
+          command: |
+            # Modified from:
+            # https://docs.codecov.io/docs/about-the-codecov-bash-uploader#validating-the-bash-script
+            curl -s https://codecov.io/bash > codecov;
+            VERSION=$(grep 'VERSION=\".*\"' codecov | cut -d'"' -f2);
+            shasum -a 512 -c <(curl -s https://raw.githubusercontent.com/codecov/codecov-bash/${VERSION}/SHA512SUM | grep codecov)
+            bash codecov -f coverage/codecov.json
       - run:
           name: Run the spec tests against PostgreSQL 12
           command: postgrest-with-postgresql-12 postgrest-test-spec