3 ms·
You could use hashpipe (https://github.com/jbenet/hashpipe https://github.com/jbenet/hashpipe), from Juan Benet (the author of IPFS). It simply checks that the
by mappum 10y ago
You could use hashpipe (https://github.com/jbenet/hashpipe https://github.com/jbenet/hashpipe), from Juan Benet (the author of IPFS). It simply checks that the input to the command matches a given hash, so you can do `curl <url> | hashpipe <hash> | sh`, and if the output of the curl command is different than expected it won't be passed in to `sh`.
- eriknstr 10y agoIronically the prebuilt binaries of hashpipe itself are provided without means of verification :I So if you are going to use hashpipe, I think you should download it in source form, read it -- it's under 100 SLOC -- and then build it from source yourself. This way, you do that once and then in the future provided that you trust those sending you various scripts and binaries and the channel they used to provide the hash, all is well and no further manual verification is needed on your side of things ever again for any of those.
- dbdr 10y agoIf an attacker can modify the output of the curl command (on the host or on the wire), cannot they also modify the value of the hash seen and copy-pasted by the end-user? I must be missing something...