T08 · Insecure Dependencies
Warning
- Location
- DESIGN.md:208
- Finding
- Unverified Binary Downloads Installed into a System-Wide Executable Directory## Vulnerability Details **File Location**: `DESIGN.md:208-213` **Vulnerability Type**: Supply-chain exposure through unverified binary installation **Risk Level**: Medium ### Vulnerable Code ```bash # ripgrep curl -LO https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz tar xzf ripgrep-*.tar.gz && cp ripgrep-*/rg /usr/local/bin/ # fd curl -LO https://github.com/sharkdp/fd/releases/download/v10.2.0/fd-v10.2.0-x86_64-unknown-linux-musl.tar.gz tar xzf fd-*.tar.gz && cp fd-*/fd /usr/local/bin/ ``` ### Technical Analysis The design document instructs users to download executable archives, extract them, and copy the resulting binaries into `/usr/local/bin` without verifying a cryptographic signature or pinned checksum. The URLs use HTTPS, fixed release versions, and the apparent upstream GitHub repositories. This reduces—but does not eliminate—the risk. Compromise of a release asset, publisher account, repository, or local TLS trust chain could cause an altered executable to be installed. The wildcard expressions `ripgrep-*.tar.gz`, `ripgrep-*/rg`, `fd-*.tar.gz`, and `fd-*/fd` introduce an additional local substitution risk. If these commands are run in a directory containing attacker-controlled matching archives or extracted directories, `tar` or `cp` may process an unintended artifact. The instructions also do not isolate extraction in a newly created private temporary directory. The executable script itself does not automatically perform these downloads. At `scripts/search.sh:28` and `scripts/search.sh:37`, it only prints fixed installation URLs. Therefore, the risk arises when a user or administrator follows the installation procedure in `DESIGN.md`. ### Attack Path 1. A user follows the fallback dependency-installation instructions in `DESIGN.md`. 2. An attacker compromises an upstream release asset or causes an attacker-controlled local archive or extracted directory to match one of the wildca ...[truncated 1212 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer distribution packages from trusted, configured operating-system repositories. 2. If release archives must be used, pin the expected SHA-256 digest and verify it before extraction: ```bash archive="ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz" curl --fail --location --proto '=https' --tlsv1.2 \ --output "$archive" \ "https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/$archive" echo '<PINNED_SHA256> ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz' | sha256sum --check --strict - ``` 3. Verify an upstream cryptographic signature where the publisher provides one. 4. Download and extract inside a newly created private directory, such as one produced by `mktemp -d`, and clean it with a shell trap. 5. Replace every wildcard with an exact archive, directory, and binary name. 6. Inspect the extracted file type and permissions before installation. 7. Require explicit user approval before installing software. 8. Prefer a user-owned executable directory when system-wide installation is unnecessary. 9. If `/usr/local/bin` installation is required, perform only the final verified copy with the minimum necessary elevation. 10. Document the trusted source, exact version, checksum, expected architecture, and update procedure.