News for hackers. Stuff that matters.

A comment on Show HN: Checksum.sh verify every install script. Parent comment

Re:Show HN: Checksum.sh verify every install script by gavinuhma on Friday October 28, 2022 @07:24PM (#33379260)
That’s right. The checksum shouldn’t be provided by the site. I’m producing the checksum myself after reviewing the install scripts manually. Once I produce the checksum I can keep relying on it. The install scripts don’t tend to change very often.
[ Parent | on HN ]
Re:Show HN: Checksum.sh verify every install script by jwong_ on Friday October 28, 2022 @08:50PM (#33379811)
so you’re storing the checksums locally for each script then?

is that much different than just storing the verified copies of the scripts?

[ Parent | on HN ]
Re:Show HN: Checksum.sh verify every install script by gavinuhma on Friday October 28, 2022 @09:10PM (#33379929)
Storing them in the readme which others can use as well. I jump around to new machines a lot so I can reference checksum.sh if I want to install rust for example
[ Parent | on HN ]
Re:Show HN: Checksum.sh verify every install script by jwong_ on Saturday October 29, 2022 @12:12AM (#33380899)
Makes sense, congrats on shipping!
[ Parent | on HN ]
Re:Show HN: Checksum.sh verify every install script by IshKebab on Saturday October 29, 2022 @05:53PM (#33388316)
That makes some kind of sense. The original post makes you sound like you're one of those crazy people who thinks e.g. Flatpak is fine but curl | bash is horribly insecure.

However I'm still not sure it really makes sense. Do you also manually review the code of the binaries that the bash scripts download?

[ Parent | on HN ]