4 ms·
From the article: === Partial content: the shell may execute half the script due to a network error. Easily fixable by running in a function: do_work()
by mbreese 7y ago
From the article:
===
Partial content: the shell may execute half the script due to a network error.
Easily fixable by running in a function:
do_work() {
:
}
do_work
All of the cited examples already do this.
===
This is the one argument that I think the author gets wrong. Just because the projects he cited do this correctly doesn't mean that all `curl install.sh | sh` scripts will do this correctly. And this is the main fear that I have. I'm not all that concerned about people publishing malicious installation shell scripts. These things are normally public, so it would be easy for them to get caught. I am concerned about the scripts being either (a) altered in transit or (b) corrupted in transit (which is really the same thing).
It seems like there could be some happy medium where there was an install script that had a published signature (SHA1 and/or full cryptographically signed), and a tool that downloaded it, verified the signature, and then called a standard function: `my_install()` (or something).
- t0astbread 7y agoWell, altered in transit and corrupted in transit are both covered by HTTPS. (I think error detection is even covered in TCP, hence also HTTP?) If a vendor does deliver software over HTTP, then you should verify the script before executing it via a checksum delivered over some secure channel. (This is also what apt, the Debian package manager, does by default afaik.)
- falcolas 7y agoNot just a checksum, a cryptographic signature, which verifies both the contents, and that the contents are from the owner of the key.
- mbreese 7y agoIt's still possible for data to be silently corrupted before it hits the HTTPS server [1]. After dealing with a similar issue that corrupted data silently, but still had valid checksums, I tend to not trust implicit checks. (My example wasn't an HTTPS specific issue, but it in theory could still happen with HTTPS). [1] https://stackoverflow.com/questions/34610581/is-it-necessary-to-verify-checksum-when-data-is-sent-over-https https://stackoverflow.com/questions/34610581/is-it-necessary...