T08 · Insecure Dependencies
Error
- Location
scripts/install.sh:181- Finding
Downloaded Native Installer Executes When Integrity Verification Is Unavailable
- Content
View full analysis
/dev/null; then curl -fsSL -O "${installer_url}" elif command -v wget &> /dev/null; then wget -q "${installer_url}" else log_error "curl or wget was not found; download the installer manually" exit 1 fi if [ "$os" != "windows" ]; then chmod +x "${installer_name}" fi local platform_key="${os}-${arch}" local expected_checksum="${CHECKSUMS[$platform_key]}" if [ -n "$expected_checksum" ]; then local actual_checksum="" if command -v sha256sum &> /dev/null; then actual_checksum=$(sha256sum "${installer_name}" | awk '{print $1}') elif command -v shasum &> /dev/null; then actual_checksum=$(shasum -a 256 "${installer_name}" | awk '{print $1}') else log_warn "sha256sum/shasum was not found; skipping integrity verification" fi if [ -n "$actual_checksum" ]; then if [ "$actual_checksum" != "$expected_checksum" ]; then log_error "SHA-256 verification failed" rm -f "${installer_name}" exit 1 fi fi else log_warn "No checksum is available for the current platform; skipping verification" fi ./${installer_name} --yes ``` ### Technical Analysis The script downloads a native executable from an external CDN and immediately grants it execution permission. Although expected SHA-256 values are embedded for supported platforms, verification fails open in two cases: 1. Neither `sha256sum` nor `shasum` is installed. 2. No checksum exists for the detected platform. In either case, the script continues to `./${installer_name} --yes`. HTTPS protects the transport connection but does not replace artifact-level authenticity verification. A compromised CDN origin, certificate trust chain, release pipeline, or local network environme ...[truncated 1360 chars]- Remediation
View remediation