3 ms·
We came up with a way to do gpg verified curl | bash for ZeroTier. It still works without gpg too. Scroll down to Linux. https://zerotier.com/download.shtml ht
by api 8y ago
We came up with a way to do gpg verified curl | bash for ZeroTier. It still works without gpg too. Scroll down to Linux.
https://zerotier.com/download.shtml https://zerotier.com/download.shtml
- e12e 8y agoQuote(trying to fit it to narrow widt, for others on mobile): curl -s \ 'https://pgp.mit.edu/pks/lookup?op=get&search=0x1657198823E52A61' | gpg --import \ && if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi It's interesting - it tries to import a given gpg key from keyserver, then grabs a gpg armored text file with a bash header - with the gpg header wrapped in a here-document: #!/bin/bash <<ENDOFSIGSTART= -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ENDOFSIGSTART= I'm unsure, but I think you could just stick your malicious code before the signature? #!/bin/bash sudo much_evil <<ENDOFSIGSTART= -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ENDOFSIGSTART= So it really isn't any better, as far as I can tell. There's also a trade-off between scripts that can be typed (curl https://i.com.com https://i.com.com) and need copy-pasting - as copy-pasting also isn't safe - even if that's a somewhat different attack vector (compromising the web site, altering js depending on visitor).
- api 8y agoPutting malicious code before the signature doesn't work because gpg chops it out. It only outputs the verified part. It is definitely a kludge though.