Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Checksum.sh verify every install script

checksum.sh

Post reply on HN
Print view View original

51–60 of 77 posts

Re: Show HN: Checksum.sh verify every install script

#51

Post by gavinuhma »

kazinator wrote: post #47

This function is flawed, containing unquoted variable interpolations: s=$(curl -fsSL $1) ... c=$(echo $s | shasum | awk '{print $1}') what it means is that the checksum is being calculated on a whitespace-mangled version of the data that is pulled down from the web. It appears to work because the author calculated the checksums with the same script and is just validating that they are not changing. In other words, it…

Thanks, I believe this is fixed now in the /checksum.sh file but I forgot to update the function on the website

Re: Show HN: Checksum.sh verify every install script

#52

Post by gavinuhma »

jwong_ wrote: post #48
gavinuhma wrote: post #44

Earlier quoted context omitted.

That’s right. The checksum shouldn’t be provided by the site. I’m producing the checksum myself after reviewing the install scripts manually. Once I produce the checksum I can keep relying on it. The install scripts don’t tend to change very often.

so you’re storing the checksums locally for each script then? is that much different than just storing the verified copies of the scripts?

Storing them in the readme which others can use as well. I jump around to new machines a lot so I can reference checksum.sh if I want to install rust for example

Re: Show HN: Checksum.sh verify every install script

#54

Post by bigiain »

Jarwain wrote: post #25
tomrod wrote: post #21

Earlier quoted context omitted.

I'm not terribly deep in this space. What is the conceptual difference of hash vs GPG sig?

Hash essentially proves that the file you downloaded is the same as the file that was uploaded. It tells you nothing about Who uploaded the file. An attacker could make you download their own file, but then the hash of the file won't match what's published (unless the attacker changes the published hash). A GPG sig proves that the file was signed & uploaded by the author, which defacto doubles as proof that it's the…

I don’t think that’s a real problem here though.

I couldn’t care less if the Chinese government hosts an install script, if there’s no possibility they could have changed a single byte of the script.

Assuming I have a trusted way of knowing the installer script hash (which is a big assumption), I don’t need authentication for the script download, I only need integrity checks.

Re: Show HN: Checksum.sh verify every install script

#55

Post by gavinuhma »

gavinuhma wrote: post #51
kazinator wrote: post #47

This function is flawed, containing unquoted variable interpolations: s=$(curl -fsSL $1) ... c=$(echo $s | shasum | awk '{print $1}') what it means is that the checksum is being calculated on a whitespace-mangled version of the data that is pulled down from the web. It appears to work because the author calculated the checksums with the same script and is just validating that they are not changing. In other words, it…

Thanks, I believe this is fixed now in the /checksum.sh file but I forgot to update the function on the website

Ok should be fixed now. Appreciate you pointing it out. That whitespace trick is really interesting

Re: Show HN: Checksum.sh verify every install script

#56

Post by woodruffw »

michaelmior wrote: post #49
woodruffw wrote: post #45

I think this is a worthy cause, but maybe a little misguided: the problem with "curl-piping" isn't so much the fact that you're throwing a random shell script into your shell, but the fact that you're downloading arbitrary code in a way that's disconnected from the normal integrity/authenticity guarantees of a package manager. In other words: you can be confident in the bootstrapping script you've just downloaded bec…

> that script is just going to download more binaries from the Internet Not necessarily. A number of these scripts either configure a package manager or the shell script contains the binary itself which is unpacked when the script is run.

Sure, I suppose that's possible. Most of the ones I'm familiar with just download an architecture-compatible binary from a CDN somewhere.

Even if there's a shar-style[1] packed binary in the script, you have no idea what that binary does when you verify that the checksum is correct.

Re: Show HN: Checksum.sh verify every install script

#57

Post by yourad_io »

gavinuhma wrote: post #3
ithkuil wrote: post #2

Awesome. I made something similar in https://github.com/mkmik/runck But I didn't but a fancy domain name :-)

Haha thanks! Honestly when I saw the domain was available it motivated me to finish the project and share it

Domain driven development

Re: Show HN: Checksum.sh verify every install script

#60

Post by gavinuhma »

charcircuit wrote: post #58

This just shifts the trust to the checksum. How do you know you downloaded the right checksum? Checksum the checksum? Whatever you are doing to protect sending the checksum can also be used for protecting the script itself.

Agree. Although checksums are smaller and easier to copy/paste. Same with a url.

I download the script from A, and the checksum from B. And then I verify them locally. So A and B both need to be compromised. It all assumes the script was safe to begin with, and this just verifies that nothing has changed

Post reply on HN