A system for signed installers to replace curl

A system for signed installers to replace curl | sh

Posted by matt2000 on Saturday January 23, 2016 @10:58AM
from the github.com dept.

( 3 comments | 4 points | on HN )

Re:A system for signed installers to replace curl | sh by gemma on Saturday January 23, 2016 @04:30PM (#10960191)

Author here, just noticed this submission. Happy to answer any questions. (You may also be interested in the discussions on Proggit[0] and /r/golang[1].)

[0] https://www.reddit.com/r/programming/comments/426zsv/pipethi...

[1] https://www.reddit.com/r/golang/comments/4261he/pipethis_sto...

[ Parent | on HN ]

Re:A system for signed installers to replace curl | sh by smt88 on Saturday January 23, 2016 @11:08AM (#10958771)

This seems to make downloading scripts safer when encryption isn't supported by the server. Is that true, or am I way off base?

(For those reading who are incredulous that a reasonable person would ask you to download an installation script over unencrypted HTTP, you are right to be incredulous. Even some large-ish companies do it. It's insane.)

[ Parent | on HN ]

Re:A system for signed installers to replace curl | sh by gemma on Saturday January 23, 2016 @04:28PM (#10960183)

Yup. It adds an extra identity verification layer, whether your script is served over SSL or not.

[ Parent | on HN ]