I read TFA. Why would a truncated partial download happen and still run the script?
[deleted]
"So that a truncated partial download doesn't end up executing half a script"
41–50 of 87 posts
Re: "So that a truncated partial download doesn't end up executing half a script"
#42I read TFA. Why would a truncated partial download happen and still run the script?
A truncated download might happen for all sorts of reasons, like your internet connection dropping while you download the script. If you don't notice you might accidentally run an incomplete script and leave your system in some broken or at least confusing state. They wrapped everything in a main function to prevent that from happening
Re: "So that a truncated partial download doesn't end up executing half a script"
#43A serious question for any Linux-heads here, no insult intended. How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this? I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN? Does that mean that if I want to write an app that runs on Linux…
Normally it's not your job to package it yourself the distro maintainers do that
Re: "So that a truncated partial download doesn't end up executing half a script"
#44Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
Everyone says this, but nearly nobody does it. Just like security through open source, it's more a nice myth than a reality.
[deleted]
Re: "So that a truncated partial download doesn't end up executing half a script"
#45Earlier quoted context omitted.
The xz situation proved the opposite: if you're up against someone smart, you won't read the script (and you'll think you have).
The xz situation proved that while you didn't read the script, someone did detect the problem. It shows the benefit of many-eyes.
[deleted]
Re: "So that a truncated partial download doesn't end up executing half a script"
#46Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
My obligatory yearly scream into the void that the preferred way to install Rust is still `curl https://sh.rustup.rs | sh`
But security!
Re: "So that a truncated partial download doesn't end up executing half a script"
#47A serious question for any Linux-heads here, no insult intended. How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this? I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN? Does that mean that if I want to write an app that runs on Linux…
The only proper approach is to come up with a twelfth package manager that will encompass all the other eleven.
Re: "So that a truncated partial download doesn't end up executing half a script"
#48A serious question for any Linux-heads here, no insult intended. How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this? I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN? Does that mean that if I want to write an app that runs on Linux…
It's like anything else, it depends on how many people you want to get. Apt alone will get you 50%. Add pacman and that's another 30%. Yum is another 15%. Nix is another 2%. Foo is another 0.3%, bar 0.1%, and so on and so on. (Numbers are made up).
You don't have to do anything, it's just about how convenient you want to make it.
Re: "So that a truncated partial download doesn't end up executing half a script"
#49Earlier quoted context omitted.
As opposed to downloading a binary install file?
Distributors usually give you a way to verify that what you've downloaded is correct, usually through checksums, PGP signatures, code signing... You forego that if you pipe the script to your shell. What if you make a typo and somehow pipe an HTML document to your shell? If you're unlucky this could wreak havoc.
From the threat vectors you presented, I assume you already trust the vendor. That means you trust their installation script. You are, after all, going to run their binary after the installation!
In this case, I assume the reason to inspect the script is not so much that the script might be doing something bad, but rather that you may have downloaded the wrong file to begin with.
With that in mind:
> Distributors usually give you a way to verify that what you've downloaded is correct
The first thing is that not all software is downloaded from Linux distribution repositories. This technique doesn't work if you're just downloading an installer from a website or Github releases page, etc. Sure, many also provide you with a checksum that you need to manually verify, but the shell script in question can also do the same. In fact, it can help by automating the check after it inevitably downloads the application's binary package.
In this case, the vector is you getting something different from what the vendor intended you to download. An example would be if your connection had been MITM'ed and a malicious package had been sent in its place.
This is largely a non-issue these days with TLS certs everywhere, SNI, OCSP stapling and other protections that more or less ensure you're connected to the right server.
> What if you make a typo and somehow pipe an HTML document to your shell?
That's quite the bad luck!
In this case, the user made a typo.
Most `curl | bash` commands are copy-pasted from a website rather than typed out, so this is _mostly_ a non-issue as well.
For those cases where the user typed the command and got it wrong, for it to become a problem, at least these 2 things need to be true:
* the typoed URL actually downloaded something that the shell can interpret
* there are commands in this downloaded document that actually wreak havoc to the system where they ran
Re: "So that a truncated partial download doesn't end up executing half a script"
#50Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
A far better advice would be to:
Unless you're read to fully analyze all the code and look for problems in the whole code, instead of just the install script, don't be an eager early adopter of every project you see posted somewhere, wait for it to have some social validation, give it sometime so smarter people with more time than us had their time looking for vulnerabilities in the whole code, not only on the script. Or if you really want to check it, use an isolated VM first.