3 ms·

wget -O - https://example.com/install.sh https://example.com/install.sh | vim A work around I've been using for a while. I then :saveas and execute it myself o

• general_failure 13y ago
  wget -O - https://example.com/install.sh https://example.com/install.sh | vim -
• e12e 13y ago
  Personally I prefer to save to file, then inspect (with less or vim) -- but some scripts are a little too clever. Lein is one great example of something that works, but at the same time is pretty scary (read time-consuming to verify by hand). Another favourite are those tiny installers that wrap a nice "curl http://yeah.not.ssl.com/boom.sh http://yeah.not.ssl.com/boom.sh | sudo -s" inside the "installer". Great for building confidence in a project. Maybe the best thing to do is to just distribute the shell scripts encrypted with the private key of the project, thereby forcing users to run it through gpg. Or use a gpg-archive -- both PGP and GPG has support for this, see gpg-zip(1). That way you can at least establish a chain of trust that goes straight back to the author, and links the installer(s) directly with a gpg-key. It's not really possible to get anything better than that. And you avoid having a separate .sig-file. Apparently there's also a GNU project for distributing signed archives -- but it doesn't appear to have wide support.
  • bigiain 13y ago
    Which reduces the problem to hip, cool projects telling newbies to just: wget -O - http://example.ru/public.key http://example.ru/public.key | gpg --fast-import && sudo gpg --trust 0xABADIDEA