T08 · Insecure Dependencies
Error
- Location
scripts/fetch_scanner.sh:25- Finding
Unsigned Precompiled Scanner Processes Production Cloud Credentials
- Content
View full analysis
/dev/null; then ACTUAL=$(sha256sum "$TMP" | cut -d' ' -f1) else ACTUAL=$(shasum -a 256 "$TMP" | cut -d' ' -f1) fi if [ "$ACTUAL" != "$EXPECTED" ]; then fail "校验和不匹配 — 已丢弃下载内容" exit 1 fi mv "$TMP" "$DEST/$FILE" ``` The documentation then instructs users to execute the extracted binary with cloud credentials: ```bash ./aliyun-scanner ``` The checksum manifest explicitly states that the values were calculated by the maintainer from files downloaded from the same COS location and that the upstream publisher did not provide signatures or an official checksum manifest. ### Technical Analysis The downloader correctly uses HTTPS, requires TLS 1.2 or later, and fails closed when a SHA-256 value is missing or mismatched. These controls protect against later accidental corruption or replacement of the pinned artifact. They do not establish the provenance or trustworthiness of the original executable. The binary is: - Precompiled and not auditable from the project source. - Unsigned by an independently authenticated publisher. - Expected to receive cloud credentials. - Expected to enumerate production cloud resources. - Trusted using hashes generated from the same remote artifacts rather than an independent release-signing channel. Consequently, a malicious original build, compromised publisher account, or compromised maintainer release process could produce a binary that performs the advertised scan while also collecting credentials or infrastructure information. The flagged ne ...[truncated 1379 chars]- Remediation
View remediation