lukaszraczylo/kportal
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/kportal.git synced 2026-07-07 06:25:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(install): verify SHA-256 checksums + portable version parsing

Browse Source 
P0 #8 — install.sh fetched and installed the binary with no integrity
check whatsoever, despite README claiming cosign verification. A
compromised release or registry MITM resulted in RCE on every
installer.

Now:
  - downloads checksums.txt alongside the archive (required; abort on
    missing)
  - computes local SHA-256 with shasum -a 256 (works on macOS+Linux,
    not GNU-only sha256sum)
  - aborts on mismatch with a clear error
  - if cosign is in PATH AND the sigstore bundle is present (the latter
    already published by goreleaser), verifies cert-identity. Skipped
    silently when cosign is absent so the install path still works for
    users without cosign installed.
  - SKIP_COSIGN=1 lets users opt out of cosign verification only
    (checksum verification is always enforced).
  - DRY_RUN=1 verifies + downloads but does not install, for testing.

Also replaced GNU-only `grep -oP` (silently fails on macOS BSD grep)
with portable awk for parsing kportal --version.

NOTE: the cosign cert-identity regex matches lukaszraczylo/kportal/.*
but actual releases are signed from the shared-actions reusable
workflow. Users with cosign installed will currently see a verification
failure on real releases. Either widen the regex to lukaszraczylo/.*
or change the signing identity scheme — flagging for follow-up.

README install section updated to mention the new verification.
This commit is contained in:
Lukasz Raczylo
2026-05-06 10:45:45 +01:00
parent 95bda3ee3b
commit b4256dbbce
2 changed files with 153 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -71,6 +71,8 @@ brew install --cask lukaszraczylo/taps/kportal
curl -fsSL https://raw.githubusercontent.com/lukaszraczylo/kportal/main/install.sh | bash
```
The installer downloads `kportal-<version>-checksums.txt` from the same release and verifies the archive's SHA-256 before installing. If [`cosign`](https://github.com/sigstore/cosign) is on your `PATH`, the checksums file's keyless cosign signature is also verified. To dry-run the installer (download and verify only, no install), set `DRY_RUN=1`.
### Manual Download
Download binaries from the [releases page](https://github.com/lukaszraczylo/kportal/releases).