Re:`gosh` is security theater for piped shell scripts
by wwrap on Saturday April 09, 2011 @09:09PM
(#2428546)
This is a good start.
I don't know ruby but if I did I'd change the sha256 stuff to GPG. Could support searching for local GPG keys with URL and/or the username out of the github URL. Asks which to use if multiple matches are found, should remember the choice. If there isn't a local key already, support querying specific known keyservers. mit's and ubuntu's come to mind.
Might poke around with this in bash in a week or two.
I don't know ruby but if I did I'd change the sha256 stuff to GPG. Could support searching for local GPG keys with URL and/or the username out of the github URL. Asks which to use if multiple matches are found, should remember the choice. If there isn't a local key already, support querying specific known keyservers. mit's and ubuntu's come to mind.
Might poke around with this in bash in a week or two.