Make Scripts Optionally "Offline"

[newzealandpaul]

I posted this in discussion over at tteck's original repo discussion. tteck never responded which is quite understandable.

This project is going to be a target for malicious actors, if not now, at least in the future. It would be nice easier to be malicious with these scripts that with XZ, and we all know how that turned out when the original maintainer was unable to continue.

I think a first step would be to make scripts be able to run offline. Here is what I posted last month:

The last time I checked, scripts pull code automatically from the github repo. So even if you checkout the entire repo, you will still be pulling scripts from the github repo. The cron updater, for example, pulls new code every time it runs.

Having the scripts be able to run "offline" (by that I mean not executing bash scripts pulled dynamically from the internet) would be a useful feature. This way updated scripts can be easily audited.

I am not suggesting @tteck, who does such a incredible job, would inject anything malicious. But given how widely these scripts are deployed this repo is likely a target by malicious actors.

...

1. Checkout the https://github.com/tteck/Proxmox repository

2. Run a selected script from the checked out repository using bash eg. raw/main/ct/mongodb.sh

3. When raw/main/ct/mongodb.sh is run, it runs locally and does not pull in any scripts from https://raw.githubusercontent.com/tteck/

4. If I want to update the scripts to the latest version, I run git pull origin

Right now in step 3. https://raw.githubusercontent.com/tteck/Proxmox/main/misc/build.func is pulled using curl even if the script is running from a checked out repository (Step 1.)

[Mellowlynx]

1, you already got an answer there
2. duplicate of #11

[newzealandpaul]

@Mellowlynx I agree this does look like a duplicate, although I was unclear on your answer.

Making the scripts run this way would be a few extra characters and a simple awk replace over the repo:

[ -f "main/misc/build.func" ] && source "main/misc/build.func" || source <(curl -s https://raw.githubusercontent.com/community-scripts 

[Mellowlynx]

I think it was originally done this way to make the development of the individual scripts easier.
And In my eyes, this also makes it easier to check the scripts for malicious code.
As the reused scripts like build.func are almost never updated so contrubutions to these files, should put everyone on a higer alert.

There would also be a need for a local scripts update function, and you will have all the files on all you nodes.
So up and downsides for both.

But I agree we should take a look at the options to improve security.
I like your hash values idea, but than for the scripts itself as extra check.
This is something that needs some investigation of the options and time to discuss them.

[judeibe]

While I get the want to want to cache it. More sophisticated tools have this feature like maven and gradle. I do not think this is trying to be that. Tools like brew do not use a cache at all. At some point you need to trust the source or don't trust it at all.

[judeibe]

@Mellowlynx Yah it would need a lot of vetting and work to make it fool proof.