5 ms·

PSA: Eget That Executable from GitHub

47 points by tarasglek 2y ago

athorax 2y ago
Not exactly the same, but aqua is a similar tool in this space https://github.com/aquaproj/aqua https://github.com/aquaproj/aqua
sneak 2y ago
This is effectively giving Microsoft RCE on your computer. We trust github.com and small-time publishers far too much. There’s a reason Debian packages software and runs mirrors.
- cl3misch 2y ago
  True, but if you install it anyway (like the author), might as well do it with this tool.
- atomicnumber3 2y ago
  Short of that, I really like the AUR model, especially -git packages. The scripts are so simple they can actually feasibly be reviewed (for the average arch Linux AUR user, anyway?) and are usually just "clone, make, install".
- hamandcheese 2y ago
  But where does Debian get the source for those packages? I agree that github is uncomfortably large, but the problem isn't this tool, and the solution isn't something Debian can achieve on their own.
- dishsoap 2y ago
  You probably already give Microsoft RCE on your computer (or Apple, or the maintainers of your linux distro, etc).
  - Zambyte 2y ago
    I'm curious why you think this is true of GNU/Linux distributions. I can't think of any besides Ubuntu (Snap) that this really makes sense for.
    - TillE 2y ago
      Unless you're running Gentoo or similar, you're trusting your distro maintainers to produce clean, non-malicious binaries any time you install anything from the package manager.
      - a1o 2y ago
        I don't think people read the code before running a build with portage
      - Zambyte 2y ago
        Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. It's not an inevitable truth like it is with Windows or (usually) Ubuntu (not sure about MacOS).
        Joker_vD 2y ago
        > Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. In my experience, auditing compiled executables is hard. How do you do this?
        mass_and_energy 2y ago
        So what's your approach? Are you Amish? Or did you compile every component of your setup (UEFI firmware and [C,G]PU microcode included) from source after auditing it? Or are you just convinced that a system that can't have a third party run arbitrary code simply can't exist? Please elaborate.
captn3m0 2y ago
Figuring out the “latest” release can happen via the 302 redirect that GitHub offers on releases/latest/ - no API needed. It also works directly for artifact URLs.
duckkg5 2y ago
This seems to be inspired by the smelly nerds meme https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to_github_and_i_have_lots_to_say/?share_id=PgaydUZlRDobIywviJrnb&utm_content=1&utm_medium=android_app&utm_name=androidcss&utm_source=share&utm_term=1&rdt=60452 https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to...
oalders 2y ago
https://github.com/houseabsolute/ubi https://github.com/houseabsolute/ubi does a nice job of fetching binaries from GitHub. Just give it a repo and a location to place the binary. ubi --project oalders/is --in ~/local/bin
__MatrixMan__ 2y ago
Glad to see that there's a `--verify-sha256=` flag. I prefer hard-coded hashes in my code so that when the file changes, I'm made aware. I've lost so much time chasing bugs back to a dependency which changed without a version bump and whose hash was checked by a script that just got the hash it was checking at runtime.
kayson 2y ago
Similarly, there's Obtainium for Android. I love it for open source apps. https://github.com/ImranR98/Obtainium https://github.com/ImranR98/Obtainium
- tarasglek 2y ago
  Awesome, thank you
alt187 2y ago
> However, I’m firmly on the side of using GitHub for everything because projects that use alternatives to GitHub are special snowflakes that make everything harder for me as a user. Good.
- pmarreck 2y ago
  It would be way better if tooling was hub-agnostic and compatible with all git:// style url's so that github would not be a SPOF as well as a single point of monopolizing
- nexus_six 2y ago
  There are privacy and data integrity issues with GitHub for both enterprise and personal use. Gitlab and other self-hosted alternatives are nearly exactly the same. I don't know if "by harder for me as a user" they mean the web-facing frontend, or something else. And even then something like Gitlab offers the exact same feature set as Github does on the web frontend. On a sidenote this is the same "but x is so much more convenient" mentality that is driving open source projects to lock all their documentation behind something like a Discord chatroom instead of having a proper docs page or wiki.
- immibis 2y ago
  Why do you like monopolies? GitHub is already abusing its position by refusing to let me have an account without SMS verification, and refusing to let me delete my account without SMS verification.
  - alt187 2y ago
    > Why do you like monopolies? GitHub is already abusing its position by refusing to let me have an account without SMS verification, and refusing to let me delete my account without SMS verification. I'm against Github. I think that nuance got lost.
bitbasher 2y ago
I like the idea, but I can't imagine using it for a few reasons. 1. There's a catch-22. In order to fetch binaries you need to first install eget. 2. You need to trust eget to not be (or become) malicious. Perhaps #1 can be resolved by providing it as a proxy service and not an executable. For example, "wget eget.net/gopls@latest" which then usings eget on the server to grab/cache the binary and send it back. Then again, that would mean putting even more trust in eget.

47 points by tarasglek 2y ago

Not exactly the same, but aqua is a similar tool in this space https://github.com/aquaproj/aqua https://github.com/aquaproj/aqua

sneak 2y ago

This is effectively giving Microsoft RCE on your computer. We trust github.com and small-time publishers far too much. There’s a reason Debian packages software and runs mirrors.

cl3misch 2y ago
True, but if you install it anyway (like the author), might as well do it with this tool.
atomicnumber3 2y ago
Short of that, I really like the AUR model, especially -git packages. The scripts are so simple they can actually feasibly be reviewed (for the average arch Linux AUR user, anyway?) and are usually just "clone, make, install".
hamandcheese 2y ago
But where does Debian get the source for those packages? I agree that github is uncomfortably large, but the problem isn't this tool, and the solution isn't something Debian can achieve on their own.
dishsoap 2y ago
You probably already give Microsoft RCE on your computer (or Apple, or the maintainers of your linux distro, etc).
- Zambyte 2y ago
  I'm curious why you think this is true of GNU/Linux distributions. I can't think of any besides Ubuntu (Snap) that this really makes sense for.
  - TillE 2y ago
    Unless you're running Gentoo or similar, you're trusting your distro maintainers to produce clean, non-malicious binaries any time you install anything from the package manager.
    - a1o 2y ago
      I don't think people read the code before running a build with portage
    - Zambyte 2y ago
      Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. It's not an inevitable truth like it is with Windows or (usually) Ubuntu (not sure about MacOS).
      - Joker_vD 2y ago
        > Choosing to download and run programs is not giving someone else RCE, unless you download and run something that allows for RCE. In my experience, auditing compiled executables is hard. How do you do this?
        mass_and_energy 2y ago
        So what's your approach? Are you Amish? Or did you compile every component of your setup (UEFI firmware and [C,G]PU microcode included) from source after auditing it? Or are you just convinced that a system that can't have a third party run arbitrary code simply can't exist? Please elaborate.

captn3m0 2y ago

Figuring out the “latest” release can happen via the 302 redirect that GitHub offers on releases/latest/ - no API needed. It also works directly for artifact URLs.

duckkg5 2y ago

This seems to be inspired by the smelly nerds meme https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to_github_and_i_have_lots_to_say/?share_id=PgaydUZlRDobIywviJrnb&utm_content=1&utm_medium=android_app&utm_name=androidcss&utm_source=share&utm_term=1&rdt=60452 https://www.reddit.com/r/github/comments/1at9br4/i_am_new_to...

oalders 2y ago

https://github.com/houseabsolute/ubi https://github.com/houseabsolute/ubi does a nice job of fetching binaries from GitHub. Just give it a repo and a location to place the binary. ubi --project oalders/is --in ~/local/bin

__MatrixMan__ 2y ago

Glad to see that there's a `--verify-sha256=` flag. I prefer hard-coded hashes in my code so that when the file changes, I'm made aware. I've lost so much time chasing bugs back to a dependency which changed without a version bump and whose hash was checked by a script that just got the hash it was checking at runtime.

kayson 2y ago

Similarly, there's Obtainium for Android. I love it for open source apps. https://github.com/ImranR98/Obtainium https://github.com/ImranR98/Obtainium

tarasglek 2y ago
Awesome, thank you

alt187 2y ago

> However, I’m firmly on the side of using GitHub for everything because projects that use alternatives to GitHub are special snowflakes that make everything harder for me as a user. Good.

pmarreck 2y ago
It would be way better if tooling was hub-agnostic and compatible with all git:// style url's so that github would not be a SPOF as well as a single point of monopolizing
nexus_six 2y ago
There are privacy and data integrity issues with GitHub for both enterprise and personal use. Gitlab and other self-hosted alternatives are nearly exactly the same. I don't know if "by harder for me as a user" they mean the web-facing frontend, or something else. And even then something like Gitlab offers the exact same feature set as Github does on the web frontend. On a sidenote this is the same "but x is so much more convenient" mentality that is driving open source projects to lock all their documentation behind something like a Discord chatroom instead of having a proper docs page or wiki.
immibis 2y ago
Why do you like monopolies? GitHub is already abusing its position by refusing to let me have an account without SMS verification, and refusing to let me delete my account without SMS verification.
- alt187 2y ago
  > Why do you like monopolies? GitHub is already abusing its position by refusing to let me have an account without SMS verification, and refusing to let me delete my account without SMS verification. I'm against Github. I think that nuance got lost.

bitbasher 2y ago

I like the idea, but I can't imagine using it for a few reasons. 1. There's a catch-22. In order to fetch binaries you need to first install eget. 2. You need to trust eget to not be (or become) malicious. Perhaps #1 can be resolved by providing it as a proxy service and not an executable. For example, "wget eget.net/gopls@latest" which then usings eget on the server to grab/cache the binary and send it back. Then again, that would mean putting even more trust in eget.