What's the point of signature verification if you get the signature and the binary from the same server? I appreciate the lack of pretenses of `curl | sudo bash`.
Well, an attacker would need to first steal the private keys before they could generate the forged signatures.
So, while you could still change the public keys in the instructions and trick first-comers to install a back-doored archive, you'd still be caught in a heartbeat by everyone else who already trusted the legitimate keys (which are published via a keyserver.)
The chances and rewards of a successful, long-lasting attack are pretty slim, especially compared to those against other curl-bang installers (brew, oh-my-zsh...)
Being able to install something is only half of the issue. I wouldnt touch a language for production where i have to setup my environment myself completely without package control.
Re:Swift on the Server (2020)
by GoOnThenDoTell on Sunday April 25, 2021 @08:40PM
(#26938156)
It kinda implies that no one writes Unix tools in swift, otherwise it would already be packaged in the disto of your choice
Indeed the prominence given to pgp signature verification is a breath of fresh air compared to the current wave of pipe-shell intros: it's not gatekeeping to ask a would-be programmer to exercise some reading skills and internalize the idea of signature verification.
:)