Re:Show HN: Checksum.sh verify every install script
by gavinuhma on Friday October 28, 2022 @07:24PM
(#33379260)
That’s right. The checksum shouldn’t be provided by the site. I’m producing the checksum myself after reviewing the install scripts manually. Once I produce the checksum I can keep relying on it. The install scripts don’t tend to change very often.
Re:Show HN: Checksum.sh verify every install script
by jwong_ on Friday October 28, 2022 @08:50PM
(#33379811)
so you’re storing the checksums locally for each script then?
is that much different than just storing the verified copies of the scripts?
Re:Show HN: Checksum.sh verify every install script
by gavinuhma on Friday October 28, 2022 @09:10PM
(#33379929)
Storing them in the readme which others can use as well. I jump around to new machines a lot so I can reference checksum.sh if I want to install rust for example
Re:Show HN: Checksum.sh verify every install script
by jwong_ on Saturday October 29, 2022 @12:12AM
(#33380899)
Makes sense, congrats on shipping!
Re:Show HN: Checksum.sh verify every install script
by IshKebab on Saturday October 29, 2022 @05:53PM
(#33388316)
That makes some kind of sense. The original post makes you sound like you're one of those crazy people who thinks e.g. Flatpak is fine but curl | bash is horribly insecure.
However I'm still not sure it really makes sense. Do you also manually review the code of the binaries that the bash scripts download?
If the script is deliberately malicious as originally published, then the publisher will provide a valid checksum; so it doesn't help.
If the script source is subverted by an attacker, then it only helps if the attacker doesn't also have the means to change the published checksum too.
If an attacker can modify the site which publishes the URL for the script and the checksum, they can modify both at the same time.