Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Checksum.sh verify every install script

checksum.sh

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Show HN: Checksum.sh verify every install script

#31

Post by XCSme »

thewataccount wrote: post #26
XCSme wrote: post #23

Earlier quoted context omitted.

> would also just change the hash listed too In my project I "host" the hash on a different medium, so in order to compromise the file download the attacker would have to compromise both the file hosting server and the hash hosting medium (which in my case is GitHub). I also don't really display the hashes, as the download only happens when the script is updated, so your current version of the script will check the h…

Interesting idea, Does the script get the new version url&expected hash from the website alone? Or does it get the expected hash from the website, then calculate the URL from github? Basically I'm wondering if that prevents just needing to attack the website - if the url to download the update and the expected hash are in the same place then it's still a single point of failure.

The latest file download URL is always the same /latest, hosted on my server.

The version number and latest file hash are also fixed URLs, stored on GitHub.

So for an update, the script checks GitHub for latest version number, if newer it downloads the latest version from my server, computes the hash and compares it to the hash stored on the fixed GitHub URL before proceeding.

I think there's no way to replace the file with a malicious one that will be distributed to the users unless you get access to both my server and the GitHub repository.

Re: Show HN: Checksum.sh verify every install script

#32

Post by gavinuhma »

dundarious wrote: post #20
gavinuhma wrote: post #17

Earlier quoted context omitted.

Got it. Thanks. Re --check, I suppose the way to do that would be to download the file to disk, which --check requires as fair as I can tell. So I could download the file to disk, --check, and then remove it. I think most of these installs scripts are trying not to leave any artifacts around from install, other than the resulting binary.

You only need to create a temp file for the checksum file, not the downloaded contents. In the below example, no file exists on disk with the contents of `$s`. > $ s='1 2' > $ printf %s\\n "$s" | shasum -a 256 > tmp.sum > $ printf %s\\n "$s" | shasum --check tmp.sum > -: OK So you can just `printf '%s -\n' "$c" > tmp.sum` and check with `printf %s\\n "$s" | shasum --check --status tmp.sum || { echo "checksum failed"…

Solid! I couldn’t figure this out which I why I stopped using “—-check”. I’ll take a look

Re: Show HN: Checksum.sh verify every install script

#33

Post by pvg »

thewataccount wrote: post #19

Serious question - What is the benefit of verifying a hash? Are we really worried about file integrity? Why don't people use GPG? The hash only verifies file integrity, and that the content of the url doesn't switch the script later. But keep in mind in most scenerios, and attacker would also just change the hash listed too (they're usually on the same website). This only mitigates one very specific attack. Why don't…

Because for all of its problems, Web PKI is a working, practical, large scale system of verification and GPG isn't - you don't get much by trying to replicate what your web browser and CAs do for you but clunkier.

Re: Show HN: Checksum.sh verify every install script

#34

Post by thewataccount »

XCSme wrote: post #31
thewataccount wrote: post #26

Earlier quoted context omitted.

Interesting idea, Does the script get the new version url&expected hash from the website alone? Or does it get the expected hash from the website, then calculate the URL from github? Basically I'm wondering if that prevents just needing to attack the website - if the url to download the update and the expected hash are in the same place then it's still a single point of failure.

The latest file download URL is always the same /latest, hosted on my server. The version number and latest file hash are also fixed URLs, stored on GitHub. So for an update, the script checks GitHub for latest version number, if newer it downloads the latest version from my server, computes the hash and compares it to the hash stored on the fixed GitHub URL before proceeding. I think there's no way to replace the fi…

Yeah I think that should work.

It does have the downside still that changes to the website/github might break future updates in a way that isn't (easily) verifiable.

While this is a solution personally I still like the idea of GPG more since it'll work for any new files, works for your new projects automagically, etc.

But I think you did at least fix the future update problem with auto-updates, which is a lot more work then most people put into it so thank you for addressing the issue!

Re: Show HN: Checksum.sh verify every install script

#35

Post by yjftsjthsd-h »

dundarious wrote: post #8

There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…

If I may pile on with a general suggestion for people writing shell scripts: Use shellcheck. Always. It will catch these things automatically for you:)

Re: Show HN: Checksum.sh verify every install script

#36

Post by yjftsjthsd-h »

jandrese wrote: post #18
gavinuhma wrote: post #14

Earlier quoted context omitted.

It's really interesting. There should be a massive ledger of checksums for software

It's called apt. Or dnf. Or most any package manager. Having a gigantic general list runs into the problem of how do you update it and how do you verify the updates?

You use GPG and trust the people publishing things, who sign the artifact that you actually download. Which is internally how every package manager I've seen works internally, anyways.

Re: Show HN: Checksum.sh verify every install script

#38

Post by gavinuhma »

dontbenebby wrote: post #30

>The pattern of downloading and executing installation scripts without verifying them has bothered me for a while. Thanks for sharing this work OP! I didn't see a license mentioned -- did you intend this to go into the public domain? I like how you set up a cool domain name and did some sick graphics, but I'm not sure how I can legally use your code in the future. That being said, I appreciate the work you put into t…

Good catch. Let me add a license

Re: Show HN: Checksum.sh verify every install script

#39

Post by dontbenebby »

gavinuhma wrote: post #38
dontbenebby wrote: post #30

>The pattern of downloading and executing installation scripts without verifying them has bothered me for a while. Thanks for sharing this work OP! I didn't see a license mentioned -- did you intend this to go into the public domain? I like how you set up a cool domain name and did some sick graphics, but I'm not sure how I can legally use your code in the future. That being said, I appreciate the work you put into t…

Good catch. Let me add a license

Thanks, it wasn't meant in a gotcha way.
Post reply on HN