[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#34125: Installation script needs to be secured with a gpg signature
From: |
Björn Höfling |
Subject: |
bug#34125: Installation script needs to be secured with a gpg signature |
Date: |
Fri, 25 Jan 2019 22:25:47 +0100 |
On Tue, 22 Jan 2019 08:18:09 +0100
Ricardo Wurmus <address@hidden> wrote:
> Hi Björn,
>
> > I was looking at the installation video from Laura (not yet public)
> > and wondered about that:
> >
> > We just download the installation script:
> >
> > $ wget https://.../guix-install.sh
> >
> > Then we go on directly executing that script.
> >
> > Shouldn't that be save-garded by a PGP-signature too?
>
> I don’t know.
>
> > Because if it is not, the user could be tricked into a script that
> > downloads a "bad" Guix installation tarball.
>
> To avoid having the user tricked we use HTTPS. At least the users
> will know that this file comes from the official project website.
>
> A user who is tricked into downloading a script from a malicious site
> could just as well download a matching signature from somewhere else,
> so the script body itself should be signed. We can’t sign the whole
> file because the first line must be the shebang — unless we forgo the
> shebang and the “chmod +x” instruction and ask people to execute it
> with “sudo bash guix-install.sh”. “gpg --clear-sign” adds a block of
> text before and after the file, which would be a syntax error in a
> shell script.
>
> We are probably stuck with having a separate signature file. I don’t
> know if it’s worth doing when HTTPS is used to fetch the script from
> an authoritative source.
>
OK, agreed. Let's close this.
Björn
pgpjga5eCkPiQ.pgp
Description: OpenPGP digital signature