1–10 of 77 posts
I started messing around with a way to verify the checksum of scripts before I execute them. I've found it a really useful tool for installing things like Rust or Deno.
It's written entirely as a shell script, and it's easy to read and understand what's happening.
I hope it may be useful to someone else!
But I didn't but a fancy domain name :-)
Awesome. I made something similar in https://github.com/mkmik/runck But I didn't but a fancy domain name :-)
checksum() {
hash="$1"
file="$2"
sha256sum -c checksum() {
hash="$1"
file="$2"
printf '%s %s' "$hash" "$file" | sha256sum -c
}
I also think it's weird to use `alias` inside a function, instead of just using a parameter to store the name of the program to execute.
Just remember that any script that fetches anything else remotely would still pass the checksum as only the initial script is checked.
Just remember that any script that fetches anything else remotely would still pass the checksum as only the initial script is checked.
1. Never use echo to output untrusted content as the first argument
Let's say `s='-e 1\n2'`, then `echo $s` will output:
> 1
> 2
Instead of:
> -e 1\n2
Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`.
2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable
Similarly, unquoted variable expansion re-tokenizes the contents and will not preserve spaces appropriately. Say `s='"ab"'` (where each is a literal ' ', HN seems to be collapsing 2 spaces down to 1), then `echo $s` will output:
> "ab"
Instead of:
> "ab"
You can get the latter with `echo "$s"` but use `printf %s\\n "$s"` to fix both issues.
PS: If you fail to use quoted expansion with printf, for example like so, `printf %s\\n $s`, then you'll notice the problem right away, as it will effectively turn that into `for i in $s ; do printf %s\\n "$i" ; done`. That's actually a very useful feature of printf if you know to use it.
Edit: These problems exist for bash/POSIX sh at least. Perhaps you're using a shell that works differently, like zsh, because otherwise issue 2 would probably have led to some checksum fails for you already.
Why not use the -c option? Especially if you're using Bash or Zsh which has "here-strings": checksum() { hash="$1" file="$2" sha256sum -c Or if you need to use a POSIX-ish shell: checksum() { hash="$1" file="$2" printf '%s %s' "$hash" "$file" | sha256sum -c } Of course you can add a `--binary` option (uses '%s *%s' instead of '%s %s'), options to use different hash functions, etc. I also think it's weird to use `alia…
I'll work through these suggestions. Appreciate it. Feel free to send a PR if you want.
For the here string I think that won't work because the file isn't being saved locally, it's just being piped (so $2 is a URL). I can't do the usual `shasum -c <<< "132e320edb0027470bfd836af8dadf174e4fee00 install.sh" which takes a local filename but not the file content. As far as I could tell anyway. I'll try it some more
There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…