Hacker News Reader

Comment by Thaxll | Hacker News Reader

Seriously when people will stop using that for installation....

"curl -sL https://asciinema.org/install | sh"

Still a cool product!

This is something I have been fighting with in my head for quite a while. "Piping shit into sh" is not really great way to do it, I fully agree. Let me describe you the situation.

At the moment there are native packages for Ubuntu/Debian (ppa) and Fedora/CentOS (in core repo). There's also homebrew package and Arch Linux one (aur). There are 2 nice guys who maintain the first two packages, doing great job, but it always takes time until the packages are ready (we're all doing it in our spare time, and there's process, especially Fedora case, which you can't skip). I maintain Arch Linux one (while not using Arch for more than few years now) but this one's usually ready on the release day.

There are no packages for other distros, but we'll never be able to provide ones for all distros (unless we're very popular project with lots of contributors). That's fine.

But there are also situations like this: https://bugs.gentoo.org/show_bug.cgi?id=532918 Let's not get into "Go packaging" discussion again, but what you can see in the mentioned Gentoo thread there's always some problem (no vendoring is bad, vendoring is bad). Sure, these guys do this too in their spare time and they don't owe me anything.

But when seeing this I'm like "oh boy, packaging is hard, I don't have time for dealing with this". So time (or lack of thereof) is one thing. Next thing is: "apt-get install asciinema" or "brew install asciinema" is awesome because it uses your software package manager and it's a single command. For all other distros (and people wanting new version right now) you can curl/sh which is equally easy. "First download this script, then review it, then run it" is not that hard but most people wouldn't review the script anyway, and those who would are the ones who are doing that now anyway. curl/sh sucks on many fronts but I made sure the script doesn't get executed when partially downloaded and it's not "| sudo sh".

I'm thinking about using one of these services which auto-build deb/rpm, they host them as apt/yum repos etc. There are few of them out there so if anyone can point me to any "proven/reliable" one I'd appreciate that. Any suggestions on the topic are welcome!

I added an RPM package to a project that used a Makefile to spin up a docker container which then built various packages via FPM:

https://github.com/jordansissel/fpm

I didn't use the build system heavily and it may be more overhead than you'd like but I thought it was a pretty neat way of doing things. Repo is here:

https://github.com/tutumcloud/tutum-agent

What's wrong with that? It is SSL secured.

Once you agree to install software, it had local access with your accounts privileges.

piping random shit into sh is wrong because domains go away, yet installation instructions might be repeated in countless other tutorials. easy to snap up domains and host malware.

and SSL has nothing to do with it. packages are not cryptographically signed either and once on the system can easily become root.

Once you've installed it you've given local privileges (or even root) to the app, so you're hosed anyway.

I think the bigger danger is that since you're instructing a direct pipe-to-sh over the network without regard to exit status, you're running the risk of executing truncated code that could trash your system state.

The author addresses this issue by wrapping the script [1] in {} braces:

    { # Prevent execution if this script was only partially downloaded
    # installation code here
    } # End of wrapping

I'm not sure if this is a bulletproof solution.

[1] https://asciinema.org/install

That's correct. In case bash doesn't see closing braces it will error out with "syntax error" and won't execute anything.

It's pretty rare for an app to need root privileges. You typically need root to write to the system dirs (/usr/* /bin etc). And in this particular case, the app has access (by design) to your terminal, so yeah, you need to trust the app a bit. But why would you need to demand all users of your system (even if that's just system users) also trust it?

Put it in ~/opt with xstow, and add ~/opt/bin to your path, ~/opt/man to your man-path, ~/opt/include, ~/opt/lib... to the various paths.

In this case, it seems like a lot of effort to get a tgz-archive just to download a single executable. I gather it's distributed as an archive in order for the Changelog, Readme and License to be available -- but as it's all downloaded from github anyway, it's hard to see why that really matters (rather than just have -h spit out a link or two).

As, if you're using a normal, full-featured web browser, there's no way of knowing if what you select, is what you copy and then paste -- it would probably be better to just link directly to the latest binary release for the various platforms (linux32, linux64, linux-arm, OSX 32bit, OSX 64bit) -- and let the user save the binary somewhere.

Limit the "command line instructions" to:

  go get github.com/asciinema/asciinema

rather than fighting idiomatic go practices.

If you really want to be clever, why not just use 0install?

http://0install.net/

Would this be better if the pasted command included some checksum which was checked before piping into the `sh`? Can anyone who's better at bash than me give an example of how this could work in a relatively cross-platform way?

You would need to have a GPG signature with a well-known public key that is verified before executing the code.

Sorry, can you explain why? If the checksum is provided (as part of the sh snippet) by the website with the SSL certificate, isn't that enough reassurance?

If the snippet and the download are on the same site, then whoever controls that site at the moment can provide an accurate checksum of whatever malware they want to host. A signature is an improvement because it can give you some confidence that the current controller is the same as the original controller.

> Would this be better if the pasted command included some checksum which was checked before piping into the `sh`?

hashpipe does exactly that:

https://github.com/jbenet/hashpipe

If you are doing a terminal video, I'm pretty sure you are smart enough to break down that pipe and first download, and then run it.

So why not make that the way the instructions tell you to do it?

Because as other commenters have said, anyone interested in doing that will do it anyways.

But isn't that the behavior we want to encourage everyone to have? Most people will do the default: if the default is wrong, they don't care. If the default is right, they still don't care, but at least they're doing it right.

> packages are not cryptographically signed either

Eh? Both debs and rpms can be signed with GPG keys.

You won't be so happy when your https connection drops after "/" as you are piping into /bin/sh:

  rm -rf /$INSTALLER_TEMP_DIR

See here: https://news.ycombinator.com/item?id=9754681

We evolved packaging systems for a reason - they provide a standardized way to manage dependencies, provide clean uninstalls, etc... Having a shellscript pooping files arbitrarily into the filesystem is so 90's.

Seriously - you pretty much just have to make a .dep and a .rpm and you're covered. Is that so hard?

> you pretty much just have to make a .dep and a .rpm and you're covered

Author already did that [1] and has both .deb and .rpm:

https://asciinema.org/docs/installation

When there will be a better alternative.

There's no better alternative for a very good reason.

Reply on news.ycombinator.com