Merge pull request #725 from zickgraf/codecov

Miscellaneous changes around code coverage

.circleci/config.yml

@@ -10,14 +10,13 @@ jobs:
     steps:
       - checkout
       - run: |
-          sudo apt update
-          sudo apt dist-upgrade -y
-          sudo apt install -y texlive-latex-extra texlive-science curl
+          sudo apt -o Acquire::https::Verify-Peer="false" update
+          sudo apt -o Acquire::https::Verify-Peer="false" dist-upgrade -y
+          sudo apt -o Acquire::https::Verify-Peer="false" install -y texlive-latex-extra texlive-science curl
           cd ..
           git clone --depth 1 https://github.com/homalg-project/homalg_project.git
           cd CAP_project
           TERM=dumb make ci-test
-          bash <(curl -s https://codecov.io/bash)
 workflows:
   version: 2
   commit:

.github/workflows/Tests.yml

@@ -41,7 +41,7 @@ jobs:
           TERM=dumb make -C CAP_project -j $(nproc) --output-sync ci-test
           cp ./CAP_project/.codecov.yml ./
           (cd CAP_project && LANG=C.UTF-8 python3 process_coverage_ignored_lines.py)
-          curl -s https://codecov.io/bash | bash
+          [ "${{ matrix.image }}" = "gapsystem/gap-docker-master" ] && ./CAP_project/upload_codecov.sh
           git config --global user.name "Bot"
           git config --global user.email "empty"
           cd CAP_project

upload_codecov.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -e
+
+# get GPG key
+curl -O https://keybase.io/codecovsecurity/pgp_keys.asc
+# verify fingerprint
+if ! gpg --import --import-options show-only --with-fingerprint pgp_keys.asc | grep "2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869"; then
+    echo "Downloaded GPG key has wrong fingerprint"
+    exit 1
+fi
+# import key into special keyring used by gpgv below
+gpg --no-default-keyring --keyring ~/.gnupg/trustedkeys.kbx --import pgp_keys.asc
+
+# get uploader with signatures
+curl -O https://uploader.codecov.io/latest/linux/codecov
+curl -O https://uploader.codecov.io/latest/linux/codecov.SHA256SUM
+curl -O https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig
+
+# verify
+gpgv codecov.SHA256SUM.sig codecov.SHA256SUM
+shasum -a 256 -c codecov.SHA256SUM
+
+# execute
+chmod +x codecov
+./codecov