6 ms·

> How did Codecov learn of this event? > A customer reported this to us on the morning of April 1, 2021. This customer was using the shasum that is available o

by rmorey 6y ago

> How did Codecov learn of this event? > A customer reported this to us on the morning of April 1, 2021. This customer was using the shasum that is available on our Bash Uploader to confirm the integrity of the uploader fetched from https://codecov.io/bash https://codecov.io/bash. > Once the customer saw a discrepancy between the shasum on Github and the shasum calculated from the downloaded Bash Uploader, they reported the issue to us, which prompted our investigation. shoutout to this user for actually checking the shasum

colonelpopcorn 6y ago
Why they're not continuously checking it is beyond me.
- travisjungroth 6y ago
  It seems like this would be a nice small service. Publicly compare checksums of software and flag/notify for misalignment. And maybe make it easier for people to grab the checksums for packages and check it themselves. Edit: I just bought hecksum.com.
dbrgn 6y ago
Public key signatures would be even better. Then you only need to install / audit / trust the public key once, versus updating the checksum for every new release. Of course, this assumes that signing isn't compromised too, if that's the case then you're pretty much out of luck since a malicious release would be superficially indistinguishible from a real release.
- whydoyoucare 5y ago
  Well, that is what happened in the case of SolarWinds -- legit signatures on the dll that was modified early in the supply-chain. :-(
londons_explore 6y ago
So it took 3 months from the initial modification until someone bothered to check the shasum of their download?!?
- nexuist 6y ago
  Of all the people in tech I know as friends or professionals I know of exactly one guy who is diligent about comparing checksums and it's the same guy with a multi thousand dollar homelab. Absolutely nobody is doing this frequently unless they've automated it or they have an obsession with privacy (to be fair, nothing wrong with that, just that it's exceptionally rare).
  - londons_explore 6y ago
    I guess I'm unusual - I check hashes of manually downloaded files if the domain I'm downloading from isn't the same as the domain with the download link. It only takes 5 seconds, and saves me from partial downloads too (you'd be amazed how many files kinda-almost work but have odd bugs if half downloaded)
l0b0 6y ago
Here's[1] one way to actually curl + checksum then run in a Dockerfile, in case anyone wants it: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' > get-poetry.py.sha256 \ && sha256sum --check get-poetry.py.sha256 \ && python3 get-poetry.py \ && rm get-poetry.py get-poetry.py.sha256 [1] https://github.com/linz/geospatial-data-lake/blob/d3c5699ed827aeed9dd33f59389f16b613249414/backend/Dockerfile#L6-L10 https://github.com/linz/geospatial-data-lake/blob/d3c5699ed8...
- remram 6y ago
  You can pipe directly into sha256sum, no need to write-read-delete a file: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' | sha256sum --check \ && python3 get-poetry.py \ && rm get-poetry.py Also this code is weird because it grabs the script from master and expects its hash to not change. It should probably grab a specific version of it, e.g. https://raw.githubusercontent.com/python-poetry/poetry/8b479d1559808adc6a03fcee4c42df2250363769/get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/8b479... to avoid the code breaking and needing manual update every time Poetry makes a change to their repo.
  - misnome 6y ago
    Right, but, unless GitHub itself is majorly compromised (in which case checking the bash checksum doesn’t help), doesn’t having the commit SHA in the URL make the whole exercise pointless anyway?
  - l0b0 6y ago
    Thanks for the sha256sum tip - I checked the man page, but it doesn't mention that it reads from standard input by default (only when passing the filename "-"). The code has only changed once in the few months I've been using it. Also, if we get a specific version we'd need an extra process to know when it's been updated. So for the current project it's pragmatic to just use the latest version.

by rmorey 6y ago

colonelpopcorn 6y ago

Why they're not continuously checking it is beyond me.

travisjungroth 6y ago
It seems like this would be a nice small service. Publicly compare checksums of software and flag/notify for misalignment. And maybe make it easier for people to grab the checksums for packages and check it themselves. Edit: I just bought hecksum.com.

dbrgn 6y ago

Public key signatures would be even better. Then you only need to install / audit / trust the public key once, versus updating the checksum for every new release. Of course, this assumes that signing isn't compromised too, if that's the case then you're pretty much out of luck since a malicious release would be superficially indistinguishible from a real release.

whydoyoucare 5y ago
Well, that is what happened in the case of SolarWinds -- legit signatures on the dll that was modified early in the supply-chain. :-(

londons_explore 6y ago

So it took 3 months from the initial modification until someone bothered to check the shasum of their download?!?

nexuist 6y ago
Of all the people in tech I know as friends or professionals I know of exactly one guy who is diligent about comparing checksums and it's the same guy with a multi thousand dollar homelab. Absolutely nobody is doing this frequently unless they've automated it or they have an obsession with privacy (to be fair, nothing wrong with that, just that it's exceptionally rare).
- londons_explore 6y ago
  I guess I'm unusual - I check hashes of manually downloaded files if the domain I'm downloading from isn't the same as the domain with the download link. It only takes 5 seconds, and saves me from partial downloads too (you'd be amazed how many files kinda-almost work but have odd bugs if half downloaded)

l0b0 6y ago

Here's[1] one way to actually curl + checksum then run in a Dockerfile, in case anyone wants it: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' > get-poetry.py.sha256 \ && sha256sum --check get-poetry.py.sha256 \ && python3 get-poetry.py \ && rm get-poetry.py get-poetry.py.sha256 [1] https://github.com/linz/geospatial-data-lake/blob/d3c5699ed827aeed9dd33f59389f16b613249414/backend/Dockerfile#L6-L10 https://github.com/linz/geospatial-data-lake/blob/d3c5699ed8...

remram 6y ago
You can pipe directly into sha256sum, no need to write-read-delete a file: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' | sha256sum --check \ && python3 get-poetry.py \ && rm get-poetry.py Also this code is weird because it grabs the script from master and expects its hash to not change. It should probably grab a specific version of it, e.g. https://raw.githubusercontent.com/python-poetry/poetry/8b479d1559808adc6a03fcee4c42df2250363769/get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/8b479... to avoid the code breaking and needing manual update every time Poetry makes a change to their repo.
- misnome 6y ago
  Right, but, unless GitHub itself is majorly compromised (in which case checking the bash checksum doesn’t help), doesn’t having the commit SHA in the URL make the whole exercise pointless anyway?
- l0b0 6y ago
  Thanks for the sha256sum tip - I checked the man page, but it doesn't mention that it reads from standard input by default (only when passing the filename "-"). The code has only changed once in the few months I've been using it. Also, if we get a specific version we'd need an extra process to know when it's been updated. So for the current project it's pragmatic to just use the latest version.