Show HN: Checksum.sh verify every install script

Re:Show HN: Checksum.sh verify every install script by charcircuit on Friday October 28, 2022 @11:04PM (#33380595)

This just shifts the trust to the checksum. How do you know you downloaded the right checksum? Checksum the checksum?

Whatever you are doing to protect sending the checksum can also be used for protecting the script itself.

[ Parent | on HN ]

Re:Show HN: Checksum.sh verify every install script by gavinuhma on Friday October 28, 2022 @11:14PM (#33380641)

Agree. Although checksums are smaller and easier to copy/paste. Same with a url.

I download the script from A, and the checksum from B. And then I verify them locally. So A and B both need to be compromised. It all assumes the script was safe to begin with, and this just verifies that nothing has changed

[ Parent | on HN ]

Re:Show HN: Checksum.sh verify every install script by tkk23 on Saturday October 29, 2022 @04:49AM (#33382228)

Checksum the checksum_s_

Checksum.sh could keep track of checksums. Then an attacker has to alter the original script and checksum.sh.

[ Parent | on HN ]