Skip to content

fix(security): add checksum verification for external binary downloads #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dumko2001 wants to merge 4 commits into from
Closed

fix(security): add checksum verification for external binary downloads #177

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
68cfd97
fix(security): add checksum verification for external binary downloads
dumko2001 Mar 17, 2026
50b9f0b
fix: enforce checksum verification and handle unsupported architectures
dumko2001 Mar 22, 2026
5b04d6d
fix: enforce checksum verification and handle unsupported architectures
dumko2001 Mar 24, 2026
5e78aa1
fix(security): update OpenShell to v0.0.14 and add gh fallback
dumko2001 Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 55 additions & 9 deletions scripts/brev-setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,21 +77,50 @@ if command -v nvidia-smi >/dev/null 2>&1; then
fi

# --- 3. openshell CLI (binary release, not pip) ---
OPENSHELL_VERSION="v0.0.14"
if ! command -v openshell >/dev/null 2>&1; then
info "Installing openshell CLI from GitHub release..."
info "Installing openshell CLI (${OPENSHELL_VERSION})..."
if ! command -v gh >/dev/null 2>&1; then
sudo apt-get update -qq >/dev/null 2>&1
sudo apt-get install -y -qq gh >/dev/null 2>&1
fi
ARCH="$(uname -m)"
case "$ARCH" in
x86_64 | amd64) ASSET="openshell-x86_64-unknown-linux-musl.tar.gz" ;;
aarch64 | arm64) ASSET="openshell-aarch64-unknown-linux-musl.tar.gz" ;;
x86_64 | amd64)
ASSET="openshell-x86_64-unknown-linux-musl.tar.gz"
EXPECTED_SHA="f34acf072452180adc872db207eec16f2aa77b6e2723c7456677c281d7d1d9d6"
;;
aarch64 | arm64)
ASSET="openshell-aarch64-unknown-linux-musl.tar.gz"
EXPECTED_SHA="6c70bd3112ba6524c16718b0ba37474238011d74c694b2f18aa6003da13128a5"
;;
*) fail "Unsupported architecture: $ARCH" ;;
esac
tmpdir="$(mktemp -d)"
GH_TOKEN="${GITHUB_TOKEN:-}" gh release download --repo NVIDIA/OpenShell \
--pattern "$ASSET" --dir "$tmpdir"
DOWNLOAD_SUCCESS=0

if command -v gh >/dev/null 2>&1; then
if GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "$OPENSHELL_VERSION" --repo NVIDIA/OpenShell \
--pattern "$ASSET" --dir "$tmpdir"; then
DOWNLOAD_SUCCESS=1
fi
fi

if [ "$DOWNLOAD_SUCCESS" -eq 0 ]; then
# Fallback: curl pinned release
curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/${OPENSHELL_VERSION}/$ASSET" \
-o "$tmpdir/$ASSET"
fi

# Verify checksum
if command -v sha256sum >/dev/null 2>&1; then
echo "${EXPECTED_SHA} $tmpdir/$ASSET" | sha256sum -c -
elif command -v shasum >/dev/null 2>&1; then
echo "${EXPECTED_SHA} $tmpdir/$ASSET" | shasum -a 256 -c -
else
fail "sha256sum or shasum not found. Cannot verify binary integrity."
fi

tar xzf "$tmpdir/$ASSET" -C "$tmpdir"
sudo install -m 755 "$tmpdir/openshell" /usr/local/bin/openshell
rm -rf "$tmpdir"
Expand All @@ -101,16 +130,33 @@ else
fi

# --- 3b. cloudflared (for public tunnel) ---
CLOUDFLARED_VERSION="2025.2.0"
if ! command -v cloudflared >/dev/null 2>&1; then
info "Installing cloudflared..."
info "Installing cloudflared (${CLOUDFLARED_VERSION})..."
CF_ARCH="$(uname -m)"
case "$CF_ARCH" in
x86_64 | amd64) CF_ARCH="amd64" ;;
aarch64 | arm64) CF_ARCH="arm64" ;;
x86_64 | amd64)
CF_BIN_ARCH="amd64"
EXPECTED_SHA="cbd18c5a6dee084db7a55d761b91202e47e63ddbd18d0faff04ca96e56739b3f"
;;
aarch64 | arm64)
CF_BIN_ARCH="arm64"
EXPECTED_SHA="92b8917aeb655ef8b9e90176dd9475b40ea85ec54b21bcafbdf57d9a68b72d15"
;;
*) fail "Unsupported architecture for cloudflared: $CF_ARCH" ;;
esac
tmpdir=$(mktemp -d)
curl -fsSL "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${CF_ARCH}" -o "$tmpdir/cloudflared"
curl -fsSL "https://github.com/cloudflare/cloudflared/releases/download/${CLOUDFLARED_VERSION}/cloudflared-linux-${CF_BIN_ARCH}" -o "$tmpdir/cloudflared"

# Verify checksum
if command -v sha256sum >/dev/null 2>&1; then
echo "${EXPECTED_SHA} $tmpdir/cloudflared" | sha256sum -c -
elif command -v shasum >/dev/null 2>&1; then
echo "${EXPECTED_SHA} $tmpdir/cloudflared" | shasum -a 256 -c -
else
fail "sha256sum or shasum not found. Cannot verify binary integrity."
fi

sudo install -m 755 "$tmpdir/cloudflared" /usr/local/bin/cloudflared
rm -rf "$tmpdir"
info "cloudflared $(cloudflared --version 2>&1 | head -1) installed"
Expand Down
47 changes: 37 additions & 10 deletions scripts/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,33 +323,60 @@ install_openshell() {
return 0
fi

info "Installing openshell CLI..."
OPENSHELL_VERSION="v0.0.14"
info "Installing openshell CLI (${OPENSHELL_VERSION})..."

case "$OS" in
Darwin)
case "$ARCH_LABEL" in
x86_64) ASSET="openshell-x86_64-apple-darwin.tar.gz" ;;
aarch64) ASSET="openshell-aarch64-apple-darwin.tar.gz" ;;
aarch64)
ASSET="openshell-aarch64-apple-darwin.tar.gz"
EXPECTED_SHA="f05699b74a9c60f105b7af9224f268f126256196d066de91b423bfa5be066eca"
;;
*)
fail "OpenShell ${OPENSHELL_VERSION} does not support Intel-based Macs (x86_64). Please use an Apple Silicon Mac or build OpenShell from source."
;;
esac
;;
Linux)
case "$ARCH_LABEL" in
x86_64) ASSET="openshell-x86_64-unknown-linux-musl.tar.gz" ;;
aarch64) ASSET="openshell-aarch64-unknown-linux-musl.tar.gz" ;;
x86_64)
ASSET="openshell-x86_64-unknown-linux-musl.tar.gz"
EXPECTED_SHA="f34acf072452180adc872db207eec16f2aa77b6e2723c7456677c281d7d1d9d6"
;;
aarch64)
ASSET="openshell-aarch64-unknown-linux-musl.tar.gz"
EXPECTED_SHA="6c70bd3112ba6524c16718b0ba37474238011d74c694b2f18aa6003da13128a5"
;;
esac
;;
esac

tmpdir="$(mktemp -d)"
local DOWNLOAD_SUCCESS=0

if command -v gh >/dev/null 2>&1; then
GH_TOKEN="${GITHUB_TOKEN:-}" gh release download --repo NVIDIA/OpenShell \
--pattern "$ASSET" --dir "$tmpdir"
else
# Fallback: curl latest release
curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/latest/download/$ASSET" \
if GH_TOKEN="${GITHUB_TOKEN:-}" gh release download "${OPENSHELL_VERSION}" --repo NVIDIA/OpenShell \
--pattern "$ASSET" --dir "$tmpdir"; then
DOWNLOAD_SUCCESS=1
fi
fi

if [ "$DOWNLOAD_SUCCESS" -eq 0 ]; then
# Fallback: curl pinned release
curl -fsSL "https://github.com/NVIDIA/OpenShell/releases/download/${OPENSHELL_VERSION}/$ASSET" \
-o "$tmpdir/$ASSET"
fi
Comment thread
coderabbitai[bot] marked this conversation as resolved.

# Verify checksum
if command -v sha256sum >/dev/null 2>&1; then
echo "${EXPECTED_SHA} $tmpdir/$ASSET" | sha256sum -c -
elif command -v shasum >/dev/null 2>&1; then
echo "${EXPECTED_SHA} $tmpdir/$ASSET" | shasum -a 256 -c -
else
fail "sha256sum or shasum not found. Cannot verify binary integrity."
fi

tar xzf "$tmpdir/$ASSET" -C "$tmpdir"

if [ -w /usr/local/bin ]; then
Expand Down