2

I have a command line tool (ngi) I made, and currently the process of installation requires 2 steps.

First step is to clone the repo into usr/local/ngi.

Second step is to manually set the $PATH in ~/.bash_profile (or wherever they set their environment variables) so that they can run the tool from the command line.

What I'm considering instead is this (it will shorten the installation to just one step):

I plan to create an install file in the repo, which is just a script that does the two steps above for the user. They now will be able to just open their command line and download the install script via curl, which when run, will in turn install the command line tool:

curl https://raw.githubusercontent.com/joshbeam/angular_init/install >> install_ngi; ruby install_ngi

Basically the above command just downloads the raw content of the install file from GitHub into a new local file called install_ngi, and then runs it with Ruby. The install_ngi file itself then clones the GitHub repo and sets the environment variables.

My question is, what are some safety concerns regarding this method, and is there a safer way to implement this sort of installation?

  • If you are willing to vouch for the security of one particular version, you could specify that and verify it by its hash (for example sha2sum) before using it. But that complicates updating this dependency, and only works if the problem you are worried about is not already present in the version you are pinning your install tool to in this way. – pyramids Apr 5 '15 at 22:24
  • @pyramids, really the only security concern I have would be a malicious user gaining admin access to the repo and replacing the installation file, so if a user runs curl to download the installation file, it could have been replaced by some malicious code that could harm their computer, etc. – Josh Beam Apr 5 '15 at 22:28
  • @pyramids, do you know of an online resource I can read that explains how one would implement your solution? – Josh Beam Apr 5 '15 at 22:29
  • @Josh_Bean No, but if you are willing to use a shell script in the first place, you might as well try something like sha256sum install_ngi |grep XXX-CORRECT-HASH && ruby install_ngi instead of the last command in your current solution. – pyramids Apr 5 '15 at 22:34
  • @pyramids, you'll have to excuse my inexperience with hashes. So the above would check a hash that is inside the install script against a known hash, and only run ruby install if the hashes match? Or does it convert the entire file into a hash and check it against the correct hash? – Josh Beam Apr 5 '15 at 22:40
5

Is it safe?
Not completely; just because you're fetching safe code now doesn't mean that link will always point to safe code, and many command-line tools don't verify certificates, which could lead to a MITM attack.

Is it safe enough?
Yeah, for most use cases, probably. The attack scenario is pretty rare, and an attacker who is positioned to pull it off can probably pull off something more serious.

What's a safer way to do it?
The best we can do is for all downloaded software to be cryptographically signed and for the signatures to be verified before installation. Most modern system package managers (think apt, yum, etc.) do this automatically, but you can do it yourself using gnupg.

Ideally you'd only sign a package if you've verified it and trust it. That doesn't mean you're right to trust it, but at least it makes you accountable for it. Of course, there's the problem of getting the signer's public key onto the user's computer in such a way that that transfer won't be tampered with... chicken, meet egg.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.