Show HN: Checksum.sh verify every install script

Post by gavinuhma » Sat, Oct 29, 2022, 3:17 AM UTC

dundarious wrote: post #20

gavinuhma wrote: post #17

Earlier quoted context omitted.

Got it. Thanks. Re --check, I suppose the way to do that would be to download the file to disk, which --check requires as fair as I can tell. So I could download the file to disk, --check, and then remove it. I think most of these installs scripts are trying not to leave any artifacts around from install, other than the resulting binary.

You only need to create a temp file for the checksum file, not the downloaded contents. In the below example, no file exists on disk with the contents of `$s`. > $ s='1 2' > $ printf %s\\n "$s" | shasum -a 256 > tmp.sum > $ printf %s\\n "$s" | shasum --check tmp.sum > -: OK So you can just `printf '%s -\n' "$c" > tmp.sum` and check with `printf %s\\n "$s" | shasum --check --status tmp.sum || { echo "checksum failed"…

Post by Arnavion » Sat, Oct 29, 2022, 3:39 AM UTC

    CARGO_HOME="${CARGO_HOME:-$HOME/.cargo}"
    mkdir -p "$CARGO_HOME/bin"
    curl -Lo "$CARGO_HOME/bin/rustup" 'https://static.rust-lang.org/rustup/dist/x86_64-unknown-linux-gnu/rustup-init'
    chmod +x "$CARGO_HOME/bin/rustup"
    hash -r
    rustup set auto-self-update disable
    rustup set profile minimal
    rustup default stable
    rustup update --force
    rustup self update # Create hardlinks under $CARGO_HOME/bin/

Post by xelxebar » Sat, Oct 29, 2022, 8:31 AM UTC

googlryas wrote: post #12

dundarious wrote: post #8

There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…

Great post, you are wise in the ways of the shell. Minutiae like this is exactly why I stop writing shell scripts the moment I start, and reach for python or some other sane language. But, I can't help but respect when I see masters of sh work their magic.

Post by wolletd » Sat, Oct 29, 2022, 9:38 AM UTC

googlryas wrote: post #12

dundarious wrote: post #8

There are two big problems with the use of `echo $s` in bash/POSIX sh: 1. Never use echo to output untrusted content as the first argument Let's say `s='-e 1\n2'`, then `echo $s` will output: > 1 > 2 Instead of: > -e 1\n2 Always use printf if you want to start output with untrusted content, e.g., `printf %s\\n "$s"`. 2. Never use unquoted variable expansion when trying to exactly reproduce contents of the variable Si…

Great post, you are wise in the ways of the shell. Minutiae like this is exactly why I stop writing shell scripts the moment I start, and reach for python or some other sane language. But, I can't help but respect when I see masters of sh work their magic.

Post by michaelmior » Sat, Oct 29, 2022, 11:09 AM UTC

woodruffw wrote: post #56

michaelmior wrote: post #49

Earlier quoted context omitted.

> that script is just going to download more binaries from the Internet Not necessarily. A number of these scripts either configure a package manager or the shell script contains the binary itself which is unpacked when the script is run.

Sure, I suppose that's possible. Most of the ones I'm familiar with just download an architecture-compatible binary from a CDN somewhere. Even if there's a shar-style[1] packed binary in the script, you have no idea what that binary does when you verify that the checksum is correct.