5 ms·

What if the download gets interrupted due to network error and bash runs something else than what was intended. E.g. the script has: rm -rf /tmp/something B

What if the download gets interrupted due to network error and bash runs something else than what was intended. E.g. the script has: rm -rf /tmp/something But when the pipe gets interrupted it executes: rm -rf /

plorkyeran 10y ago
The body of the shell script should be wrapped in a function which is invoked at the end. If you do not trust them to get this incredibly basic thing right, how can you possibly trust any of the other code they have written?
- _nalply 10y ago
  sandstorm.io said: «If the connection dies mid-line, bash will execute the incomplete line – however, this can be mitigated by wrapping the whole script in a bash function executed on the last line, as we do.» (Source: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...)
- RealityVoid 10y ago
  Soo, maybe a silly question... but are downloads from the internet always "linear"? Meaning they go uninterrupted from start to end and if it drops it will stop in the middle of the downloaded file? Doesn't it get "pieces" and then place them together?
  - StavrosK 10y ago
    It does get pieces, which are sequential. At least, curl does, if you don't tell it otherwise.
  - Ao7bei3s 10y ago
    It depends on your download program, but that's irrelevant because of the pipe. It has to be linearized before going through the pipe.
  - h3st 10y ago
    Packets can arrive out of order, yeah. TCP includes ordering information, so lost packets can be retransmitted and in the end everything'll be in proper order. As for UDP, I'd tell ya a UDP joke, but get it you might not.
- falcolas 10y ago
  The same way thousands of people trust Steam. You would expect a company of Valve's size to get their Linux uninstaller right, but people found out the hard way that it was removing their entire home directories. People make mistakes. Mistakes contained to programs is one thing. Mistakes in shell scripts tend to have bigger consequences.
ahazred8ta 10y ago
The https://github.com/silentbicycle/curlbash https://github.com/silentbicycle/curlbash utility can check the hash of the script and refuse to run it if there's a mismatch.

plorkyeran 10y ago

The body of the shell script should be wrapped in a function which is invoked at the end. If you do not trust them to get this incredibly basic thing right, how can you possibly trust any of the other code they have written?

_nalply 10y ago
sandstorm.io said: «If the connection dies mid-line, bash will execute the incomplete line – however, this can be mitigated by wrapping the whole script in a bash function executed on the last line, as we do.» (Source: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-pgp-verified-install https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...)
RealityVoid 10y ago
Soo, maybe a silly question... but are downloads from the internet always "linear"? Meaning they go uninterrupted from start to end and if it drops it will stop in the middle of the downloaded file? Doesn't it get "pieces" and then place them together?
- StavrosK 10y ago
  It does get pieces, which are sequential. At least, curl does, if you don't tell it otherwise.
- Ao7bei3s 10y ago
  It depends on your download program, but that's irrelevant because of the pipe. It has to be linearized before going through the pipe.
- h3st 10y ago
  Packets can arrive out of order, yeah. TCP includes ordering information, so lost packets can be retransmitted and in the end everything'll be in proper order. As for UDP, I'd tell ya a UDP joke, but get it you might not.
falcolas 10y ago
The same way thousands of people trust Steam. You would expect a company of Valve's size to get their Linux uninstaller right, but people found out the hard way that it was removing their entire home directories. People make mistakes. Mistakes contained to programs is one thing. Mistakes in shell scripts tend to have bigger consequences.

ahazred8ta 10y ago

The https://github.com/silentbicycle/curlbash https://github.com/silentbicycle/curlbash utility can check the hash of the script and refuse to run it if there's a mismatch.