GNU bug report logs - #34125
Installation script needs to be secured with a gpg signature

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 34125 in the body.
You can then email your comments to 34125 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Björn Höfling <bjoern.hoefling <at> bjoernhoefling.de>
To: <bug-guix <at> gnu.org>
Subject: Installation script needs to be secured with a gpg signature
Date: Fri, 18 Jan 2019 16:23:01 +0100

[Message part 1 (text/plain, inline)]

I was looking at the installation video from Laura (not yet public) and
wondered about that:

We just download the installation script:

$ wget https://.../guix-install.sh

Then we go on directly executing that script.

Shouldn't that be save-garded by a PGP-signature too?

Because if it is not, the user could be tricked into a script that
downloads a "bad" Guix installation tarball. That's what we are always
criticising about others wget-scripts that install whatever to the user.

WDYT?

Björn

[Message part 2 (application/pgp-signature, inline)]

Message #8 received at 34125 <at> debbugs.gnu.org (full text, mbox):

From: Ricardo Wurmus <rekado <at> elephly.net>
To: Björn Höfling <bjoern.hoefling <at> bjoernhoefling.de>
Cc: 34125 <at> debbugs.gnu.org
Subject: Re: bug#34125: Installation script needs to be secured with a gpg
 signature
Date: Tue, 22 Jan 2019 08:18:09 +0100

Hi Björn,

> I was looking at the installation video from Laura (not yet public) and
> wondered about that:
>
> We just download the installation script:
>
> $ wget https://.../guix-install.sh
>
> Then we go on directly executing that script.
>
> Shouldn't that be save-garded by a PGP-signature too?

I don’t know.

> Because if it is not, the user could be tricked into a script that
> downloads a "bad" Guix installation tarball.

To avoid having the user tricked we use HTTPS.  At least the users will
know that this file comes from the official project website.

A user who is tricked into downloading a script from a malicious site
could just as well download a matching signature from somewhere else, so
the script body itself should be signed.  We can’t sign the whole file
because the first line must be the shebang — unless we forgo the shebang
and the “chmod +x” instruction and ask people to execute it with “sudo
bash guix-install.sh”.  “gpg --clear-sign” adds a block of text before
and after the file, which would be a syntax error in a shell script.

We are probably stuck with having a separate signature file.  I don’t
know if it’s worth doing when HTTPS is used to fetch the script from an
authoritative source.

> That's what we are always
> criticising about others wget-scripts that install whatever to the user.

The criticism is aimed at “curl | sudo bash” instructions that execute
scripts off the Internet without prior inspection as root.

--
Ricardo

Message #13 received at 34125-done <at> debbugs.gnu.org (full text, mbox):

From: Björn Höfling <bjoern.hoefling <at> bjoernhoefling.de>
To: Ricardo Wurmus <rekado <at> elephly.net>
Cc: 34125-done <at> debbugs.gnu.org, Laura Lazzati <laura.lazzati.15 <at> gmail.com>
Subject: Re: bug#34125: Installation script needs to be secured with a gpg
 signature
Date: Fri, 25 Jan 2019 22:25:47 +0100

[Message part 1 (text/plain, inline)]

On Tue, 22 Jan 2019 08:18:09 +0100
Ricardo Wurmus <rekado <at> elephly.net> wrote:

> Hi Björn,
> 
> > I was looking at the installation video from Laura (not yet public)
> > and wondered about that:
> >
> > We just download the installation script:
> >
> > $ wget https://.../guix-install.sh
> >
> > Then we go on directly executing that script.
> >
> > Shouldn't that be save-garded by a PGP-signature too?  
> 
> I don’t know.
> 
> > Because if it is not, the user could be tricked into a script that
> > downloads a "bad" Guix installation tarball.  
> 
> To avoid having the user tricked we use HTTPS.  At least the users
> will know that this file comes from the official project website.
> 
> A user who is tricked into downloading a script from a malicious site
> could just as well download a matching signature from somewhere else,
> so the script body itself should be signed.  We can’t sign the whole
> file because the first line must be the shebang — unless we forgo the
> shebang and the “chmod +x” instruction and ask people to execute it
> with “sudo bash guix-install.sh”.  “gpg --clear-sign” adds a block of
> text before and after the file, which would be a syntax error in a
> shell script.
> 
> We are probably stuck with having a separate signature file.  I don’t
> know if it’s worth doing when HTTPS is used to fetch the script from
> an authoritative source.
> 

OK, agreed. Let's close this.

Björn

[Message part 2 (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.