4 ms·
I don't know; what's the threat model here? If the script is deliberately malicious as originally published, then the publisher will provide a valid checksum;
by NovemberWhiskey 4y ago
I don't know; what's the threat model here?
If the script is deliberately malicious as originally published, then the publisher will provide a valid checksum; so it doesn't help.
If the script source is subverted by an attacker, then it only helps if the attacker doesn't also have the means to change the published checksum too.
If an attacker can modify the site which publishes the URL for the script and the checksum, they can modify both at the same time.
- gavinuhma 4y agoThat’s right. The checksum shouldn’t be provided by the site. I’m producing the checksum myself after reviewing the install scripts manually. Once I produce the checksum I can keep relying on it. The install scripts don’t tend to change very often.
- jwong_ 4y agoso you’re storing the checksums locally for each script then? is that much different than just storing the verified copies of the scripts?
- IshKebab 4y agoThat makes some kind of sense. The original post makes you sound like you're one of those crazy people who thinks e.g. Flatpak is fine but curl | bash is horribly insecure. However I'm still not sure it really makes sense. Do you also manually review the code of the binaries that the bash scripts download?