Repository navigation
install: Authenticate first release before execution - #327
BenWestgate wants to merge 1 commit into
Conversation
d7a5a97 to
1befadb
Compare
|
@codex review Please review exact head |
This comment has been minimized.
This comment has been minimized.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1befadb5ae
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 1. Until the first signed release exists, bootstrap from GitHub with `git clone https://github.com/BenWestgate/Bails.git && Bails/b`. | ||
| - This mutable checkout is **not authenticated installation media**. Independently obtain and check the release-key fingerprint `89E6 BEF5 A4F5 1B71 CA8F AA35 A9AC CFC9 F87C B111` before relying on that key for future signed updates; see the [release authentication procedure](docs/RELEASES.md). | ||
| - Once a signed release exists, use authenticated release media instead of the mutable bootstrap. | ||
| 1. Obtain the CipherStick release-key fingerprint and exact release tag through an **independent trusted channel**, not this GitHub repository or this page. |
There was a problem hiding this comment.
For users installing by cloning, line 73 still says to skip to step 7. Adding this numbered item moves “Follow the CipherStick installer instructions” from step 7 to step 8, so cloned users are now directed into the authenticated initial-install procedure they were supposed to bypass, unnecessarily requiring a release fingerprint and tag and reinstalling CipherStick. Update the earlier skip instruction to step 8.
Useful? React with 👍 / 👎.
| [[ "$expected_fingerprint" =~ ^[0-9A-F]{40}$ ]] || { | ||
| echo 'Expected a 40-hex OpenPGP fingerprint.' >&2 | ||
| exit 1 |
There was a problem hiding this comment.
When a user follows the instruction to open a terminal and pastes this block directly, this exit 1 executes in the interactive shell rather than an installer subprocess. A mistyped fingerprint or tag, a signature mismatch, or any command failure under set -e therefore terminates the user's Tails shell instead of leaving the prompt available to read the failure and retry; wrap the procedure in a child Bash process or standalone script.
Useful? React with 👍 / 👎.
| Do not use values printed on this GitHub page as the trust source for the first | ||
| install. | ||
|
|
||
| On Tails, open a terminal and run the following. The commands fetch repository |
There was a problem hiding this comment.
When the GitHub repository or page is the compromised delivery path this procedure is intended to defend against, the user still obtains and executes this verification shell code from that same unauthenticated page before anything has been verified. An attacker can simply replace the comparison or archive commands and execute mutable content, so independently obtaining only the fingerprint and tag does not secure the first execution; the verifier itself must also be supplied or authenticated through the trusted channel.
Useful? React with 👍 / 👎.
BenWestgate
left a comment
BenWestgate
left a comment
There was a problem hiding this comment.
AI-assisted current-head security review: Concept ACK 1befadb (draft). The bootstrap compares the independently obtained key fingerprint, checks an annotated tag's signed name and verifies it before executing archive content. Human review still needs an independently distributed trust root, a published signed release, and a clean-Tails install test.
This branch has not been deployed
1 participant
What
Replace the mutable first-install bootstrap with a fail-closed procedure that:
Why
A mutable default-branch clone is not authenticated installation media. Selecting the tag independently also prevents a delivery path from rolling first install back by suppressing newer signed tags.
Closes #325.
Merge prerequisite
This is intentionally draft. Merge only after #223 lands, the first signed
v*release is published, and both its tag name and release-key fingerprint are available through an independent trusted channel. Until then the procedure correctly fails without executing downloaded CipherStick code.