installer.sh - network resilient issue

[Xon]

The recommended unattended install process is not resilient to network errors.

curl -O https://centminmod.com/installer.sh && chmod 0700 installer.sh && bash installer.sh

The commands after the curl will execute even if the network connection is interrupted. This will result in the arbitrary scripting being executed, which can result in expected and unknowable behaviour.

The recommended workaround is to ensure all code in a function definition, and as the very last statement execute the function wrapping the code.

[centminmod]

The recommended workaround is to ensure all code in a function definition, and as the very last statement execute the function wrapping the code.

thanks @Xon got an example ? fyi, the installer.sh is only 10kb in size

[Xon]

This is probably the best description: https://www.seancassidy.me/dont-pipe-to-your-shell.html

I'm not concerned about the security artefacts that people talk about with curl|bash, but ensuring the installer is reliable in the face of network interruptions.

Making sure the code is inside a function definition, ensures the shell will not try to execute partially interrupted shell code. Better for it to error than execute who knows what.

[centminmod]

oh i see what you mean regarding the code inside installer.sh, i though you meant the command line itself or command itself heh

most of installer.sh code is in functions https://github.com/centminmod/centminmod/blob/123.08stable/installer.sh

i'll look at it more later :)

[Xon]

👍