2 ms·
> As opposed to the Linux security best practices of curl | bash? This comparison would only be valid if almost everything you install on Windows was at least
by pmarreck 3y ago
> As opposed to the Linux security best practices of curl | bash?
This comparison would only be valid if almost everything you install on Windows was at least theoretically inspectable before installation, instead of, well, almost nothing. LOL, nice cope.
Anyway, here's a Bash function you can add to your dotfiles to add confirmation to that sort of "workflow":
confirm() {
tmpfile=$(mktemp)
# use tee to split stdin to stderr and the temporary file
tee "$tmpfile" >&2
echo >&2
# Prompt the user.
>&2 read -p "Do you want to pass this code along? [Y/n] " response < /dev/tty
case "$response" in
[nN]*)
echo "Operation cancelled." >&2
rm "$tmpfile"
exit 1
;;
*)
echo "Proceeding..." >&2
cat "$tmpfile"
rm "$tmpfile"
;;
esac
}
Now you can just take those one-shot install lines and stick this "confirm" function in the pipe like so:
curl <url> | confirm | bash ...
There's probably a slicker way to do this, if you're super into Bash. And you may want to `set -o pipefail` in general, so that the "exit" code of 1 actually gets seen...