Hacker News Reader

Comment by rmorey | Hacker News Reader

> How did Codecov learn of this event?

> A customer reported this to us on the morning of April 1, 2021. This customer was using the shasum that is available on our Bash Uploader to confirm the integrity of the uploader fetched from https://codecov.io/bash.

> Once the customer saw a discrepancy between the shasum on Github and the shasum calculated from the downloaded Bash Uploader, they reported the issue to us, which prompted our investigation.

shoutout to this user for actually checking the shasum

View on HN

So it took 3 months from the initial modification until someone bothered to check the shasum of their download?!?

Of all the people in tech I know as friends or professionals I know of exactly one guy who is diligent about comparing checksums and it's the same guy with a multi thousand dollar homelab. Absolutely nobody is doing this frequently unless they've automated it or they have an obsession with privacy (to be fair, nothing wrong with that, just that it's exceptionally rare).

I guess I'm unusual - I check hashes of manually downloaded files if the domain I'm downloading from isn't the same as the domain with the download link. It only takes 5 seconds, and saves me from partial downloads too (you'd be amazed how many files kinda-almost work but have odd bugs if half downloaded)

Why they're not continuously checking it is beyond me.

It seems like this would be a nice small service. Publicly compare checksums of software and flag/notify for misalignment. And maybe make it easier for people to grab the checksums for packages and check it themselves.

Edit: I just bought hecksum.com.

Public key signatures would be even better. Then you only need to install / audit / trust the public key once, versus updating the checksum for every new release. Of course, this assumes that signing isn't compromised too, if that's the case then you're pretty much out of luck since a malicious release would be superficially indistinguishible from a real release.

Well, that is what happened in the case of SolarWinds -- legit signatures on the dll that was modified early in the supply-chain. :-(

Here's[1] one way to actually curl + checksum then run in a Dockerfile, in case anyone wants it:

  RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \
      && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' > get-poetry.py.sha256 \
      && sha256sum --check get-poetry.py.sha256 \
      && python3 get-poetry.py \
      && rm get-poetry.py get-poetry.py.sha256

[1] https://github.com/linz/geospatial-data-lake/blob/d3c5699ed8...

You can pipe directly into sha256sum, no need to write-read-delete a file:

  RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \
      && echo '08336beb0091ab192adef2cedbaa3428dabfc8572e724d2aa7fc4a4922efb20a get-poetry.py' | sha256sum --check \
      && python3 get-poetry.py \
      && rm get-poetry.py

Also this code is weird because it grabs the script from master and expects its hash to not change. It should probably grab a specific version of it, e.g. https://raw.githubusercontent.com/python-poetry/poetry/8b479... to avoid the code breaking and needing manual update every time Poetry makes a change to their repo.

Right, but, unless GitHub itself is majorly compromised (in which case checking the bash checksum doesn’t help), doesn’t having the commit SHA in the URL make the whole exercise pointless anyway?

Thanks for the sha256sum tip - I checked the man page, but it doesn't mention that it reads from standard input by default (only when passing the filename "-").

The code has only changed once in the few months I've been using it. Also, if we get a specific version we'd need an extra process to know when it's been updated. So for the current project it's pragmatic to just use the latest version.

Reply on news.ycombinator.com