installer: no integrity pin for curl|bash of install.sh #534

New issue

Open

opened 2026-08-20 02:55:23 +02:00 by dries · 0 comments

dries commented

2026-08-20 02:55:23 +02:00

Owner

Found during review of PR #524 (feat: add one-line installer and service manager). Needs a maintainer decision on posture.

The documented one-liner fetches install.sh from the main branch over HTTPS with no tag or checksum pin. Anyone (or any CI state) that can move main changes what users execute; there is also no way to reproduce "the installer as of release X".

Options, in increasing weight:

Pin the curl URL to a release tag (.../raw/tag/vX.Y.Z/install.sh) and bump it in the README as part of the release flow.
Publish a checksum next to the release artifacts and have the README one-liner verify it before piping to bash.
Accept the risk explicitly (self-hosted Forgejo, single maintainer) and note it in the README.

The script itself already fails closed (set -euo pipefail, quoted, HTTPS-only default, no sudo), so this is purely about pinning the entry point.

Found during review of PR #524 (feat: add one-line installer and service manager). Needs a maintainer decision on posture. The documented one-liner fetches `install.sh` from the `main` branch over HTTPS with no tag or checksum pin. Anyone (or any CI state) that can move `main` changes what users execute; there is also no way to reproduce "the installer as of release X". Options, in increasing weight: 1. Pin the curl URL to a release tag (`.../raw/tag/vX.Y.Z/install.sh`) and bump it in the README as part of the release flow. 2. Publish a checksum next to the release artifacts and have the README one-liner verify it before piping to bash. 3. Accept the risk explicitly (self-hosted Forgejo, single maintainer) and note it in the README. The script itself already fails closed (`set -euo pipefail`, quoted, HTTPS-only default, no sudo), so this is purely about pinning the entry point.