3 ms·

Here's[1] one way to actually curl + checksum then run in a Dockerfile, in case anyone wants it: RUN curl --location --show-error --silent --output get-poetr

by l0b0 6y ago

Here's[1] one way to actually curl + checksum then run in a Dockerfile, in case anyone wants it: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' > get-poetry.py.sha256 \ && sha256sum --check get-poetry.py.sha256 \ && python3 get-poetry.py \ && rm get-poetry.py get-poetry.py.sha256 [1] https://github.com/linz/geospatial-data-lake/blob/d3c5699ed827aeed9dd33f59389f16b613249414/backend/Dockerfile#L6-L10 https://github.com/linz/geospatial-data-lake/blob/d3c5699ed8...

remram 6y ago
You can pipe directly into sha256sum, no need to write-read-delete a file: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' | sha256sum --check \ && python3 get-poetry.py \ && rm get-poetry.py Also this code is weird because it grabs the script from master and expects its hash to not change. It should probably grab a specific version of it, e.g. https://raw.githubusercontent.com/python-poetry/poetry/8b479d1559808adc6a03fcee4c42df2250363769/get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/8b479... to avoid the code breaking and needing manual update every time Poetry makes a change to their repo.
- misnome 6y ago
  Right, but, unless GitHub itself is majorly compromised (in which case checking the bash checksum doesn’t help), doesn’t having the commit SHA in the URL make the whole exercise pointless anyway?
- l0b0 6y ago
  Thanks for the sha256sum tip - I checked the man page, but it doesn't mention that it reads from standard input by default (only when passing the filename "-"). The code has only changed once in the few months I've been using it. Also, if we get a specific version we'd need an extra process to know when it's been updated. So for the current project it's pragmatic to just use the latest version.

by l0b0 6y ago

remram 6y ago

You can pipe directly into sha256sum, no need to write-read-delete a file: RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \ && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' | sha256sum --check \ && python3 get-poetry.py \ && rm get-poetry.py Also this code is weird because it grabs the script from master and expects its hash to not change. It should probably grab a specific version of it, e.g. https://raw.githubusercontent.com/python-poetry/poetry/8b479d1559808adc6a03fcee4c42df2250363769/get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/8b479... to avoid the code breaking and needing manual update every time Poetry makes a change to their repo.

misnome 6y ago
Right, but, unless GitHub itself is majorly compromised (in which case checking the bash checksum doesn’t help), doesn’t having the commit SHA in the URL make the whole exercise pointless anyway?
l0b0 6y ago
Thanks for the sha256sum tip - I checked the man page, but it doesn't mention that it reads from standard input by default (only when passing the filename "-"). The code has only changed once in the few months I've been using it. Also, if we get a specific version we'd need an extra process to know when it's been updated. So for the current project it's pragmatic to just use the latest version.