Repository navigation
fix(setup): checksum-verified just install instead of curl|bash (CWE-494) - #122
Conversation
Both just.systems/install.sh | bash fallbacks are replaced with install_just_verified: a pinned just 1.58.0 release binary per platform, fetched over TLS1.2+ into mktemp and sha256-checked before install (ported from hyperpolymath/standards setup.sh 3079bc12; macOS shasum fallback added). Unknown platforms fail rather than guess a target. Verified locally: real download installs just 1.58.0; a tampered digest is rejected; sh -n + shellcheck clean; hypatia scan reports no shell_download_then_run in setup.sh. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65
The advertised rsr-template-repo URL no longer exists (setup.sh was removed there in 162b02a), and the pattern is the one this script now refuses to use for just. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Repository guideline files applied to this review (2)No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (37)
🧰 Additional context used📓 Path-based instructions (2)Source excerpt: Licence **MPL-2.0** + SPDX header on every file (never AGPL).📄 CodeRabbit inference engine (CLAUDE.md) Files:
Source excerpt: SPDX: `MPL-2.0` on all new files.📄 CodeRabbit inference engine (.github/copilot-instructions.md) Files:
🔇 Additional comments (1)
📝 SummarySummary by CodeRabbit
WalkthroughThe setup script now installs just version ChangesVerified just installation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix Merge Risk: ⚪ Minimal · up to The fallback installer now verifies a pinned release before installation and stops setup on failure. No actionable merge-blocking risk was identified; normal installation checks remain appropriate. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The change substantially reduces exposure to substituted remote installer code. Remaining uncertainty concerns the initial digest provenance and interrupted or concurrent privileged installation, rather than a demonstrated new attack path. Retained concerns Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description explains the security change and branch-signing context, but it does not follow the repository template. It omits the required Changes section, checklist responses, Testing section, and Screenshots section.
✨ Finishing Touches 💡 1📝 Generate docstrings
🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the hash with care, Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| # ── Verified just install ── | ||
| # Replaces `curl https://just.systems/install.sh | bash`: piping a remote script |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
2 participants
This replaces #119. The tree is byte-identical (
git diff origin/fix/verified-just-install HEADis empty). The only change is that every commit is now signed.#119 could not merge because
mainenforcesrequired_signatures. CodeRabbit's docstring commit (3b42ef4) was pushed unsigned. That commit could only be removed by rewriting the branch with a force-push, so this branch instead cherry-picks it signed, keeping CodeRabbit as the author (a080f08).The content is unchanged from #119, which CodeRabbit approved. It installs
justfrom a pinned release binary checked against a SHA-256 digest, instead of pipingcurl https://just.systems/install.shintobash(CWE-494).The open code-scanning note on setup.sh line 130 (
download_then_run_shell) points at a comment that quotes the old one-liner. It is not live code. Hypatia's comment-line fix is in hyperpolymath/hypatia#883.🤖 Generated with Claude Code
https://claude.ai/code/session_01QFphKkDVB9pUDSCD4bkz65