4 ms·

A source tarball can (and should!) be checked against GPG signatures et. al. With curl|bash you have nothing.

• FooBarWidget 11y ago
  A bash script can be signed too. See article. How many projects provide GPG signatures for their tarballs? How often do you check signatures on tarballs?
  • 4ad 11y ago
    > How often do you check signatures? Every time you run apt-get. So the answer is almost every time.
    • FooBarWidget 11y ago
      The context of the comment is source tarballs. How often do you check the signatures on random tar.gz you download?
      • 4ad 11y ago
        tar.gz vs. curl|bash is a false dichotomy, there is no reason for either. We have better ways to install software these days. And yes, when I download tar.gz (e.g. when I am responsible of managing my own packages) I do check the signatures. You should, too.
        • tokenizerrr 11y ago
          Could you point me to the better way of installing software that will work on all Linux distros?
          • stephenr 11y ago
            District-appropriate packages. Use the right fucking tool for the job.
            • tokenizerrr 11y ago
              That will not work on all Linux distros. That is writing a specific installer for each distro, which does not satisfy my requirements and as such is not the right tool for the job.
              • stephenr 11y ago
                > That will not work on all Linux distros The result of the work to create packages using the major packaging formats will produce a series of packages that combined, will arguably work better, on more distros than your home-grown installer. > That is writing a specific installer What makes you think creating e.g. a debian package equates to "writing a specific installer". The whole point of packages is that you don't "write an installer" you provide an existing installer (the package manager/package installer) with information about what to install where.
                • tokenizerrr 11y ago
                  > The result of the work to create packages using the major packaging formats will produce a series of packages that combined, will arguably work better, on more distros than your home-grown installer. Plunking a binary in /usr/bin and some configuration files in /etc will work just about anywhere. > What makes you think creating e.g. a debian package equates to "writing a specific installer". The whole point of packages is that you don't "write an installer" you provide an existing installer (the package manager/package installer) with information about what to install where. You will probably write a script to build your package, right? That's writing an installer. Or a builder for an installer, or however you want to call it. The point is that you now have to do work for every distro you want to support, and all users without a package manager that you support is SOL.
                  • 11y ago
          • lmm 11y ago
            LSB-compliant RPMS, though there are a few aggressively antisocial distributions that don't support them as well as they should.
            • ape4 11y ago
              I just want to add my agreement to this. If the LSB (Linux Standard Base) was better supported these hacks would not be necessary.
          • rkeene2 11y ago
            AppFS :-)
  • raesene4 11y ago
    This is why signatures should be embedded into the packaging and distribution mechanism, to reduce manual steps. Looking at Dockers deployment of Content Trust as an example of this. You still have a trust decision on first use, but it's better protection than nothing.
    • kentonv 11y ago
      > You still have a trust decision on first use, but it's better protection than nothing. That's what you're getting by curl|bashing sandstorm today (if you skip the PGP verification step). Once installed the updater verifies signatures automatically.