I've always found interesting that we've grown up hearing don't install random programs from the internet/don't access random websites.
Then you go use linux and everyone copy-pastes commands other people wrote straight into the terminal.
Then you go use linux and everyone copy-pastes commands other people wrote straight into the terminal.
This is exactly the same bias in action. When I started using Linux nobody was doing that, and even if somebody gave you a script, its actions were verifiable by reading the relevant man pages.
I still don't run install.sh files I didn't read or at least skimmed, for example.
Since all the repositories are signed there must be a big breach to compromise these packages since the infrastructure is generally distributed. Different servers, keys, etc.
> What makes the shell script so special that it must be audited with care...
Because I need to know what changes I'm incorporating into my system(s), and plan accordingly, or prevent any change which is not in line with my system administration principles.
> ...but the binaries are fine?
They are not fine, but they are signed at multiple levels and checksummed, so they are a lower risk.
It’s trust all the way down and always has been. You just have a different idea of how you formally signal and convey trust than someone else.
I paste commands into the terminal because I can read exactly what they do and they are delivered over a connection where my user agent has verified the TLS certificate of the server. In fact I’m electing to trust directly rather than transitively the source of the software.
The only thing signed files prevents is modification in transit (and at rest on macOS/iOS and Windows, Linux doesn’t do that). Linux is ripe with time of check vs time of use race conditions.
For example, a well maintained APT repository contains multiple levels of signatures, and these signatures are stored in a keyring. You import the keyring, and it contains public key of every package maintainer, plus the repository manager. So, package maintainers sign their packages, and repository maintainer signs the repository, plus the packages via their checksums. Packages' own signatures and own checksums provides consistency and authenticity checks, and repository maintainer's signature makes sure that nothing in the repository moves after the repository is signed and published.
So, you have to compromise at least two private keys (or two people) to compromise a repository. If you're working with a critical repository, you can use "m of n" scheme for the repository signing keys, so you need to compromise m+1 people to do something nefarious.
> So if I send you a signed script that checksums itself before running will you run that without audit?
Hard no. You don't have a verifiable chain behind that script. Even if you do, scripts are always read and examined. Period.
> I can read exactly what they do and they are delivered over a connection where my user agent has verified the TLS certificate of the server.
Yes, a TLS certificate guarantees that MITM is impossible for now. But it doesn't guarantee that server has not been compromised and the file changed at rest. We have seen that happened in the past.
> The only thing signed files prevents is modification in transit ...
No. Both RPM and APT repositories' signature chains ensure that files are not modified at rest or at transit, plus the files are put into the repositories with an approval of a real human being.
These signatures are tip of a "web of trust" iceberg, and not mere automated signatures.
Moreover, if a software doesn't inspire confidence and doesn't pass the smell test, it doesn't get installed on my system anyway, regardless of its form.
If I have to install it, I install it to an isolated VM, and destroy the VM as soon as my work is done with it.
Anyone who's like "well I don't copy/paste shell code into my terminal" is just virtue signaling. I'm willing to bet their editor Vim/Emacs/VSCode is overflowing with plug-ins and code written by just some guy on Github. I bet they've ran containers that are written by just some guy too.
It's a really cool feature that you can just download a random binary off Github, run it, and not really have to worry about it.
I know a lot of people that use Linux and not many of them operate this way. Most care about their software sources. "Everyone" is certainly not the case.
A github author just has to put up a repo and hope that their fanbase aren't too versed in the language
Sounds like a very small internet.