I wrote hundreds of those checks in scripts, makefiles, CI and whatever else. After I found Nix (and NixOS) it's ridiculous not to use it. Use it.
Show HN: Checksum.sh verify every install script
41–50 of 77 posts
Re: Show HN: Checksum.sh verify every install script
#42I wrote hundreds of those checks in scripts, makefiles, CI and whatever else. After I found Nix (and NixOS) it's ridiculous not to use it. Use it.
I hadn’t heard of NixOS. Super cool
Re: Show HN: Checksum.sh verify every install script
#43I don't know; what's the threat model here?
If the script is deliberately malicious as originally published, then the publisher will provide a valid checksum; so it doesn't help.
If the script source is subverted by an attacker, then it only helps if the attacker doesn't also have the means to change the published checksum too.
If an attacker can modify the site which publishes the URL for the script and the checksum, they can modify both at the same time.
Re: Show HN: Checksum.sh verify every install script
#44I don't know; what's the threat model here? If the script is deliberately malicious as originally published, then the publisher will provide a valid checksum; so it doesn't help. If the script source is subverted by an attacker, then it only helps if the attacker doesn't also have the means to change the published checksum too. If an attacker can modify the site which publishes the URL for the script and the checksum…
That’s right. The checksum shouldn’t be provided by the site. I’m producing the checksum myself after reviewing the install scripts manually. Once I produce the checksum I can keep relying on it. The install scripts don’t tend to change very often.
Re: Show HN: Checksum.sh verify every install script
#45I think this is a worthy cause, but maybe a little misguided: the problem with "curl-piping" isn't so much the fact that you're throwing a random shell script into your shell, but the fact that you're downloading arbitrary code in a way that's disconnected from the normal integrity/authenticity guarantees of a package manager.
In other words: you can be confident in the bootstrapping script you've just downloaded because it passed its checksum, but that script is just going to download more binaries from the Internet.
Re: Show HN: Checksum.sh verify every install script
#46and where do we get the checksum? HN has a hall monitor mentality issue
Re: Show HN: Checksum.sh verify every install script
#47This function is flawed, containing unquoted variable interpolations:
s=$(curl -fsSL $1)
...
c=$(echo $s | shasum | awk '{print $1}')
It appears to work because the author calculated the checksums with the same script and is just validating that they are not changing.
In other words, it's possible to make whitespace changes such that the hash won't change.
Here are two scripts: a harmless one and a malicious one, which produce the same whitespace-ignorant SHA256:
$ foo='# this is a comment
> # rm -rf /'
$ echo $foo | sha256sum
8b87547d4d214038b153ce57d929be4c835b7690c930c1e83a25fc1509390cf9 -
$ foo='# this is a comment #
> rm -rf /'
$ echo $foo | sha256sum
8b87547d4d214038b153ce57d929be4c835b7690c930c1e83a25fc1509390cf9 -
(I know about GNU Coreutils' safeguard in rm against removing / recursively, by the way.)
Re: Show HN: Checksum.sh verify every install script
#48I don't know; what's the threat model here? If the script is deliberately malicious as originally published, then the publisher will provide a valid checksum; so it doesn't help. If the script source is subverted by an attacker, then it only helps if the attacker doesn't also have the means to change the published checksum too. If an attacker can modify the site which publishes the URL for the script and the checksum…
That’s right. The checksum shouldn’t be provided by the site. I’m producing the checksum myself after reviewing the install scripts manually. Once I produce the checksum I can keep relying on it. The install scripts don’t tend to change very often.
so you’re storing the checksums locally for each script then?
is that much different than just storing the verified copies of the scripts?
Re: Show HN: Checksum.sh verify every install script
#49I think this is a worthy cause, but maybe a little misguided: the problem with "curl-piping" isn't so much the fact that you're throwing a random shell script into your shell, but the fact that you're downloading arbitrary code in a way that's disconnected from the normal integrity/authenticity guarantees of a package manager. In other words: you can be confident in the bootstrapping script you've just downloaded bec…
> that script is just going to download more binaries from the Internet
Not necessarily. A number of these scripts either configure a package manager or the shell script contains the binary itself which is unpacked when the script is run.
Re: Show HN: Checksum.sh verify every install script
#50Earlier quoted context omitted.
It's called apt. Or dnf. Or most any package manager. Having a gigantic general list runs into the problem of how do you update it and how do you verify the updates?
You use GPG and trust the people publishing things, who sign the artifact that you actually download. Which is internally how every package manager I've seen works internally, anyways.
> You use GPG
“and now you have two problems.” —jwz
We haven’t been able to trust public pgp keyservers for a decade or more (possibly never, really).
So now we’re back at having to trust where-ever we get the proof from, whether that’s the file hash, or the public key.
(Which, as you say, is what package managers provide, and if you don’t trust your system’s apt/yum/pacman/whatever, then you have a bigger problem that trusting any random install shell script)