Shell Script Best Practices, from a decade of scripting things

Re:Shell Script Best Practices, from a decade of scripting t... by Beltalowda on Thursday October 27, 2022 @07:03AM (#33355822)

The .sh extension told me it's a shell script of some kind.

I don't check everything I download from the internet; I don't think anyone does. It depends on what it is, where I'm getting it from, where I'm running it, etc. There are certainly some things I will review carefully, but other things I give just a quick check to see it's not in complete shambles, and others I barely check at all. I typically run the latest Vim from master, do I check every patch to see if after 30 years Bram finally sneaked in a crypto miner or password stealer? Do the people who package Vim for the Linux distros?

[ Parent | on HN ]

Re:Shell Script Best Practices, from a decade of scripting t... by ndsipa_pomu on Thursday October 27, 2022 @07:30AM (#33356031)

There's a difference between trusting well known software such as vim (especially when packaged by a distro) and trusting shell scripts from essentially anyone. If it's a well known resource, then I'd likely trust the script without checking (e.g. adding a docker repo to Ubuntu), but otherwise I'm going to give it a quick eyeball.

I would tend to agree that scripts for downloading from the internet should have a '.sh' extension to make it clear that it's a script as opposed to a binary.

[ Parent | on HN ]

Re:Shell Script Best Practices, from a decade of scripting t... by Beltalowda on Thursday October 27, 2022 @07:48AM (#33356150)

Indeed; that was my point exactly. People complain about things like "curl https://sh.rustup.rs | sh" from the Rust homepage, but it's essentially the same as trusting "cd vim && ./configure && make && make install" (plus, if I would hide anything I'd do it in the probably quite large binary that script downloads, which is much harder to audit).

[ Parent | on HN ]