5 ms·
Would homebrew itself be problematic here? Does it do recursive cloning? At least a cursory glance at the repo suggests it might: https://github.com/Homebrew/b
by deanc 1y ago
Would homebrew itself be problematic here? Does it do recursive cloning?
At least a cursory glance at the repo suggests it might:
https://github.com/Homebrew/brew/blob/700d67a85e0129ab8a893ff69246943479e33df1/Library/Homebrew/download_strategy.rb#L1173 https://github.com/Homebrew/brew/blob/700d67a85e0129ab8a893f...
- msgodel 1y agoIt would be odd if it didn't. Although the goal of homebrew is to execute the code in the repo. The only situation where the RCE here is a problem is if you clone github repos containing data you don't want to execute. That's fairly unusual.
- leni536 1y agoThe question is whether recursive submodule checkout happens after some integrity/signature validation or before. The RCE can be an issue in the latter case.
- johncolanduoni 1y agoThere would also have to be a compromise of the transport (i.e. a MITM of HTTPS or SSH) to use this in most practical scenarios.
- leni536 1y agoIt still weakens the security, otherwise why bother with integrity/signature checks if you trust the git remote?
- deleted 1y ago[deleted]