Security implications of source/executing abra.sh from abra #199

New Issue

decentral1se · 2021-07-06T08:46:26Z

decentral1se commented

2021-07-06 08:46:26 +00:00

Is there something we should be considering here?

Packagers could indeed rm -rf / in the abra.sh but then we probably wouldn't be giving that person commit access to the repository. Someone could spoof the repositories? That sounds pretty far fetched.

I know Yunohost have a setup where they make packagers generate checksums of their scripts on the package side and then installer script validates those checksums. Do we also need to consider something like that?

Is there something we should be considering here? Packagers could indeed `rm -rf /` in the `abra.sh` but then we probably wouldn't be giving that person commit access to the repository. Someone could spoof the repositories? That sounds pretty far fetched. I know Yunohost have a setup where they make packagers generate checksums of their scripts on the package side and then installer script validates those checksums. Do we also need to consider something like that?

decentral1se added the

question

label 2021-07-06 08:46:26 +00:00

This repo is archived. You cannot comment on issues.