The installer that was a pipe

The bootstrap script installs the CLI the job needs. What should you refuse to merge?

#!/usr/bin/env bash
set -euo pipefail
cd /tmp
curl -fsSL https://get.example.dev | bash
examplectl deploy

Next puzzle in --:--:-- UTC

One try. The first answer sticks.

How to fix it

Piping a URL into bash trusts the network, DNS, and the publisher's current file. Pin a versioned artifact and check its checksum before you execute it.

curl | bash hides the script you are about to run. There is no commit SHA, no version, and no checksum in the repository. The publisher can change the file, a mirror can, or a future compromise of that host can. set -euo pipefail will notice a failed curl. It will not notice a successful curl that returns a different script than the one you read last month.

-f fails on HTTP errors. It is not a signature check.

Fix

version=1.8.2
curl -fsSL -o examplectl.tar.gz "https://example.dev/releases/${version}/examplectl.tar.gz"
echo "${expected_sha256}  examplectl.tar.gz" | sha256sum -c -
tar -xzf examplectl.tar.gz

Commit expected_sha256 next to the script, or verify a sigstore signature. The version bump should be a pull request you can diff. If the tool ships an apt repository with signed packages, use that instead of a bootstrap URL.

Sponsor this spot

Put your tool on the puzzle

One labeled card, in front of engineers who show up every day from YouTube, TikTok, and Instagram.

Advertise