Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"So that a truncated partial download doesn't end up executing half a script"

tailscale.com

Post reply on HN
Print view View original

61–70 of 87 posts

Re: "So that a truncated partial download doesn't end up executing half a script"

#61

Post by antif »

deanCommie wrote: post #34

A serious question for any Linux-heads here, no insult intended. How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this? I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN? Does that mean that if I want to write an app that runs on Linux…

Tailscale may be unique as a network appliance that users like to run on a lot of different equipment.

Used GPT-3.5 to summarize these and tried to edit the response for brevity. Pardon any hallucinations here. Looks like it's mostly just different OSs all running their own software publishing/distribution portals. Lot of NIH maybe.

""" 1. apt: Debian, Ubuntu.

2. yum: Red Hat / replaced by DNF.

3. dnf (Dandified YUM): Red Hat, Fedora / successor to yum.

4. tdnf (Tiny DNF): lightweight DNF for minimalist distros.

5. zypper: SUSE/openSUSE.

6. pacman: Arch Linux, Manjaro.

7. pkg: FreeBSD.

8. apk: Alpine Linux.

9. xbps Void Linux.

10. emerge: Gentoo Linux.

11. appstore: Apple / iOS, macOS. """

Re: "So that a truncated partial download doesn't end up executing half a script"

#62

Post by obi1kenobi »

arp242 wrote: post #51
obi1kenobi wrote: post #2

The shell script starts with the following comment: # All the code is wrapped in a main function that gets called at the # bottom of the file, so that a truncated partial download doesn't end # up executing half a script.

Most of these scripts have been doing that for years.

I'm sure of it. And yet based on this rapidly getting to the front page, it seems like many of us are part of today's lucky ten thousand: https://xkcd.com/1053/

Might be more than ten thousand, even, based on the reactions :)

Re: "So that a truncated partial download doesn't end up executing half a script"

#63

Post by seeknotfind »

Scaevolus wrote: post #18
bombcar wrote: post #4

I've seen scripts (self-extracting archives for Linux, for example) that checksum themselves either by some trickery, or just ignoring the first line after the shebang (which itself is the computed checksum of the rest of the file).

Incorporating an MD5 quine into a shellscript would be funny.

And a sha256 quine would be terrifying. :)

Re: "So that a truncated partial download doesn't end up executing half a script"

#64

Post by wiktor-k »

wongarsu wrote: post #28
LeoPanthera wrote: post #12

Earlier quoted context omitted.

How is this different to Windows users downloading a .exe file and running it?

Windows checks the code signing certificate of the exe, and if it isn't present and the binary not widely used shows you a big scary warning to discourage you from running it. And if the exe is signed that at least tells you where to send the police after you were infected. Of course open source projects rarely sign their exes because those certificates are expensive ($300+/year).

> Windows checks the code signing certificate of the exe, and if it isn't present and the binary not widely used shows you a big scary warning to discourage you from running it.

Actually even if the file is correctly signed but is new users will see the warning banners. (Unless using the more expensive EV Code Signing certs)

> Of course open source projects rarely sign their exes because those certificates are expensive ($300+/year).

I'm not sure where the $300/ year comes from but one can get valid certs for less than 50 EUR a year (https://shop.certum.eu/open-source-code-signing-on-simplysig...). I got a physical key one for 65 EUR and it worked just fine.

If the open source project is widely recognizable I'd suggest contacting https://signpath.org/ to get code signing for free (as in beer) via simple Github Action workflow.

Re: "So that a truncated partial download doesn't end up executing half a script"

#65

Post by ykonstant »

bombcar wrote: post #6
yau8edq12i wrote: post #3

Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.

Everyone says this, but nearly nobody does it. Just like security through open source, it's more a nice myth than a reality.

I do it; I like messing with install scripts and optimize them. My next big yak shaving project will be to optimize rkhunter. Did you know it is a 20K line POSIX shell script? I read through it a couple of times, and there's significant potential for improvement both in performance and in its security. For me it's a lot of fun because I like programming in Bourne-derived shells.

Re: "So that a truncated partial download doesn't end up executing half a script"

#66

Post by kcb »

stavros wrote: post #48
deanCommie wrote: post #34

A serious question for any Linux-heads here, no insult intended. How is it possible that there are ELEVEN different possible package managers that need to be supported by an installation script like this? I can understand that some divergences in philosophical or concrete requirements could lead to two, three, or four opinionated varieties, but ELEVEN? Does that mean that if I want to write an app that runs on Linux…

It's like anything else, it depends on how many people you want to get. Apt alone will get you 50%. Add pacman and that's another 30%. Yum is another 15%. Nix is another 2%. Foo is another 0.3%, bar 0.1%, and so on and so on. (Numbers are made up). You don't have to do anything, it's just about how convenient you want to make it.

Surely pacman is nowhere near as popular as yum/dnf.

Re: "So that a truncated partial download doesn't end up executing half a script"

#67

Post by kazinator »

I mean, could you put the main function at the top of the script, so that it calls later definitions?

The problem is that the script could be truncated in such a way that it executes successfully. It defines a bunch of functions and then quits.

If you're not checking for the success or failure of the download, you're probably not checking for the success or failure of the script; something is just going to assume the script worked.

Re: "So that a truncated partial download doesn't end up executing half a script"

#68

Post by mirekrusin »

yau8edq12i wrote: post #3

Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.

    curl -fsSL https://ollama.com/install.sh | sh && ollama run llama3 "Why it is bad to curl | sh?"
...for details.

Re: "So that a truncated partial download doesn't end up executing half a script"

#69

Post by kazinator »

bombcar wrote: post #4

I've seen scripts (self-extracting archives for Linux, for example) that checksum themselves either by some trickery, or just ignoring the first line after the shebang (which itself is the computed checksum of the rest of the file).

The problem is, the wrong party is doing the check (from a security point of view, not integrity).

When we download a script from a remote domain we don't trust, we have to validate its checksum against the known one; we can't leave that to the script, which we don't trust.

Post reply on HN