4 ms·
> that script is just going to download more binaries from the Internet Not necessarily. A number of these scripts either configure a package manager or the sh
by michaelmior 4y ago
> that script is just going to download more binaries from the Internet
Not necessarily. A number of these scripts either configure a package manager or the shell script contains the binary itself which is unpacked when the script is run.
- woodruffw 4y agoSure, I suppose that's possible. Most of the ones I'm familiar with just download an architecture-compatible binary from a CDN somewhere. Even if there's a shar-style[1] packed binary in the script, you have no idea what that binary does when you verify that the checksum is correct.
- michaelmior 4y agoWell-written scripts I've seen also contain the hash of binaries that are downloaded. So as long as the hash function is good, checking the hash of the script should still ensure that the binary downloaded is what you want. > you have no idea what that binary does when you verify that the checksum is correct. This isn't any different from using a package manager. You're still downloading a binary that could do anything and you have to have some level of trust in the source.