There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…
Show HN: Checksum.sh verify every install script
11–20 of 77 posts
Re: Show HN: Checksum.sh verify every install script
#12There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…
Great post, you are wise in the ways of the shell. Minutiae like this is exactly why I stop writing shell scripts the moment I start, and reach for python or some other sane language. But, I can't help but respect when I see masters of sh work their magic.
Re: Show HN: Checksum.sh verify every install script
#13There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…
For more caveats like this one I recommend reading: https://www.etalabs.net/sh_tricks.html
Re: Show HN: Checksum.sh verify every install script
#14Just remember that any script that fetches anything else remotely would still pass the checksum as only the initial script is checked.
Yep. As an example, rustup happens to be in this category as the checksums for rustc, cargo, etc. aren't checked.
It's really interesting. There should be a massive ledger of checksums for software
Re: Show HN: Checksum.sh verify every install script
#15There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…
Like this? https://github.com/gavinuhma/checksum.sh/pull/2
Missed the other `echo $s` piped into shasum. But I echo the sentiment of the another commenter that I'd rather rely on `shasum --check` to give the OK or not.
Re: Show HN: Checksum.sh verify every install script
#16Just remember that any script that fetches anything else remotely would still pass the checksum as only the initial script is checked.
It's the age old root of trust problem. In practice the good enough is that if it passes SSL/TLS authentication on the official domain then we wouldn't be able to stop an injection attack either way. Validating against the source is no good if it is the source that is compromised.
That's also kind of the issue with a lot of these shell injection attacks. Sure someone could insert environment variables or other shenanigans to take over your machine, but if they have that much control over your shell there are countless other ways they could also do it. Guarding against this one particular case doesn't buy you much.
Re: Show HN: Checksum.sh verify every install script
#17Earlier quoted context omitted.
Like this? https://github.com/gavinuhma/checksum.sh/pull/2
Missed the other `echo $s` piped into shasum. But I echo the sentiment of the another commenter that I'd rather rely on `shasum --check` to give the OK or not.
Got it. Thanks.
Re --check, I suppose the way to do that would be to download the file to disk, which --check requires as fair as I can tell. So I could download the file to disk, --check, and then remove it. I think most of these installs scripts are trying not to leave any artifacts around from install, other than the resulting binary.
Re: Show HN: Checksum.sh verify every install script
#18Earlier quoted context omitted.
Yep. As an example, rustup happens to be in this category as the checksums for rustc, cargo, etc. aren't checked.
It's really interesting. There should be a massive ledger of checksums for software
It's called apt. Or dnf. Or most any package manager. Having a gigantic general list runs into the problem of how do you update it and how do you verify the updates?
Re: Show HN: Checksum.sh verify every install script
#19Serious question - What is the benefit of verifying a hash? Are we really worried about file integrity? Why don't people use GPG?
The hash only verifies file integrity, and that the content of the url doesn't switch the script later. But keep in mind in most scenerios, and attacker would also just change the hash listed too (they're usually on the same website). This only mitigates one very specific attack.
Why don't we use GPG here? That way we can verify ownership and file integrity with at minimum TOFU, plus optional manual verification? If we're going through the work of adding a wrapper and all that, we may as well no?
This has the benefit that you only need to import the owner's cert once, all future changes have the same cert. Where hashes are obviously different every time, you have to trust the source of the hash every time it changes. With GPG at the very least you have TOFU with certs - and very best can have better assurance of the initial download too.
EDIT: Just want to clarify - I'm openly asking why the "developer community" is going the direction of hashes for script verification vs GPG signatures.
I don't mean to diminish your project, your project looks fun, and does make verifying hashes easier :)
Re: Show HN: Checksum.sh verify every install script
#20Earlier quoted context omitted.
Missed the other `echo $s` piped into shasum. But I echo the sentiment of the another commenter that I'd rather rely on `shasum --check` to give the OK or not.
Got it. Thanks. Re --check, I suppose the way to do that would be to download the file to disk, which --check requires as fair as I can tell. So I could download the file to disk, --check, and then remove it. I think most of these installs scripts are trying not to leave any artifacts around from install, other than the resulting binary.
You only need to create a temp file for the checksum file, not the downloaded contents. In the below example, no file exists on disk with the contents of `$s`.
> $ s='12'
> $ printf %s\\n "$s" | shasum -a 256 > tmp.sum
> $ printf %s\\n "$s" | shasum --check tmp.sum
> -: OK
So you can just `printf '%s-\n' "$c" > tmp.sum` and check with `printf %s\\n "$s" | shasum --check --status tmp.sum || { echo "checksum failed" > &2 ; exit 1 ; }`
Having to create temp files is a wrinkle (could probably avoid it by using process substitution if you want to give up on POSIX sh), but so is writing bash scripts in general.