As a follow up to The most secure way to allow downloading and installing an app on Mac, Windows, or Linux, I am wondering how one (such as I) may go about creating a new framework for hosting packages in a secure way. Ignoring the question of whether or not you should reinvent the wheel, I am mainly wondering for a learning exercise. In addition, I am wondering how sites like docker, homebrew, etc. might provide a more secure and robust way to download their app. Currently, homebrew is this:
/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
Docker is a download from the website
VMWare Fusion is straight from the website too. VSCode is too. That is, none of these apps (I can't think of any apps I use actually) are from the Mac App Store. Sublime. Atom (Atom is at least on GitHub). etc..
If I wanted to simply provide a shell script to install the program, how could I go about securing it properly?
Say the shell script downloads another few shell scripts, which then download either an
.iso depending on the platform however. What steps should be put in place to make this secure. That is, not using any third party package manager or publishing solutions, doing it all yourself. I'm guessing I'd do it similar to how the Linux Y project does it (referenced in the answer to the question at the top).
- Create an MD5 hash of the source code.
- Publish this MD5 hash somehow in some guaranteed secure way (I don't see how you can prevent hackers who have compromised your site, from compromising this MD5 hash).
- Let the user
curl <path>the script, then
less <script>to see the contents, etc. Then to somehow fetch the MD5 hash from some remote server I have to compare it. How does Linux Y project do this?
- Perhaps submit some final statistics to let us know the download completed safely as expected, I don't know.
Wondering if one could quickly/briefly outline the steps I would need to take to host such a download/install script so that it was optimally secure, without using any third party tools. That will help me get a deeper understanding of how this all works.
Basically I'm wondering how these third party package manager solution thingy's are considered secure. What exactly did they do that I could do too?
As a sidenote, I would like to provide two ways to download. Either the shell script curl method, or the download the package directly. But in either case I want to let them know that they should still inspect everything in case of tampering. But I don't know what that inspection process really looks like, and so am a ways off from understanding how to construct a system for aiding in security/protection too.