6 ms·
The Linux version of this is horribly wrong in so many ways. For one, you're downloading a shell script and running it with root privileges. A shell script that
by LeafStorm 15y ago
The Linux version of this is horribly wrong in so many ways. For one, you're downloading a shell script and running it with root privileges. A shell script that loads someone else's key into your system's database of trusted package signing keys, and then installs a package that can do just about anything to your system, including `rm -rf /*`.
And beyond the immediate security issues, this tramples both on the system git packages (because I doubt that Heroku uses so many advanced git features that they need the latest version) and on however you or your distro use RubyGems. Really, it would be far better to link to a page that tells you:
sudo apt-get install git-core rubygems
sudo gem install heroku foreman
- ddollar 15y agoThanks for the feedback! We made the script a link so you could check out what's going on before running it. The heroku-toolbelt .deb actually depends on system git-core and ruby1.9.1 so we shouldn't be trampling anything.
- LeafStorm 15y agoWhich is better than most people who just say "curl http://shortened.url/ http://shortened.url/ | sudo sh", but inspecting the script doesn't really reveal much about what actually happens during the install. It basically just says, "We're adding this repo to your system, you'll just have to install heroku-toolbelt and see what happens!"
- gojomo 15y agoFYI when I installed heroku-toolbelt into "Ubuntu 10.04.3 LTS", the declared prerequisites were not enough to get things working. IIRC (and am interpreting my shell history right), I also needed to install 'libopenssl-ruby' and 'ruby-full' by name.