"So that a truncated partial download doesn't end up executing half a script"
1–10 of 87 posts
Re: "So that a truncated partial download doesn't end up executing half a script"
#2The shell script starts with the following comment:
# All the code is wrapped in a main function that gets called at the
# bottom of the file, so that a truncated partial download doesn't end
# up executing half a script.Re: "So that a truncated partial download doesn't end up executing half a script"
#3Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read, execute `sh install.sh`.
Re: "So that a truncated partial download doesn't end up executing half a script"
#4I've seen scripts (self-extracting archives for Linux, for example) that checksum themselves either by some trickery, or just ignoring the first line after the shebang (which itself is the computed checksum of the rest of the file).
Re: "So that a truncated partial download doesn't end up executing half a script"
#5Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
As opposed to downloading a binary install file?
Re: "So that a truncated partial download doesn't end up executing half a script"
#6Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
Everyone says this, but nearly nobody does it.
Just like security through open source, it's more a nice myth than a reality.
Re: "So that a truncated partial download doesn't end up executing half a script"
#7Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
Re: "So that a truncated partial download doesn't end up executing half a script"
#8Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
As opposed to downloading a binary install file?
Distributors usually give you a way to verify that what you've downloaded is correct, usually through checksums, PGP signatures, code signing... You forego that if you pipe the script to your shell. What if you make a typo and somehow pipe an HTML document to your shell? If you're unlucky this could wreak havoc.
Re: "So that a truncated partial download doesn't end up executing half a script"
#9Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
As opposed to downloading a binary install file?
Having a distribution maintainer provide official packages is the best way.
Re: "So that a truncated partial download doesn't end up executing half a script"
#10Don't pipe curl/wget a script to a shell without reading what you've downloaded. This should be common sense. Do `wget $url; most install.sh` and only if you're satisfied with what you read , execute `sh install.sh`.
It is an awful habit of some open source projects to have the official way to install their software be to execute a shell script from the Internet. Nobody reads it, as they are usually quite complex and given the xz situation a well crafted shell script can seem harmless while being very dangerous.
Didn't the xz situation kinda prove that even reading the script is probably not gonna do you a lot of good if you're up against someone smart?