🛡️ Sentinel: [HIGH] Fix insecure temporary download paths in apt.sh#91
🛡️ Sentinel: [HIGH] Fix insecure temporary download paths in apt.sh#91
Conversation
Replaced hardcoded `/tmp/...` paths and current directory downloads with securely generated temporary directories (`mktemp -d`) in `tools/os_installers/apt.sh`. Co-authored-by: kidchenko <5432753+kidchenko@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
📝 WalkthroughWalkthroughThese changes implement secure temporary directory handling in shell scripts to mitigate TOCTOU and symlink attacks. A new security documentation file explains the vulnerability pattern and prevention approach, while the apt.sh installer is updated to use Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@tools/os_installers/apt.sh`:
- Around line 211-213: The install steps download Go and yq into TMP_DIR using
wget and then run privileged installs (tar into /usr/local and dpkg -i for
yq/lsd); modify the sequence in the functions or script block that uses
GO_VERSION, TMP_DIR and the yq download lines to first fetch the corresponding
checksum/signature artifact (Go .sha256 or go<version>.linux-amd64.tar.gz.sha256
and yq's checksums/signature), verify the downloaded file with sha256sum -c (or
cosign verify-blob if a signature is available) and only proceed to sudo tar -C
/usr/local -xzf "$TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz" or sudo dpkg -i
for yq/lsd when verification succeeds; for lsd note that no official checksum
may exist so either skip privileged install until integrity method is available
or validate via GitHub release provenance before invoking sudo dpkg -i.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b7585a8c-76ba-4c26-a66d-5affa9217164
📒 Files selected for processing (2)
.jules/sentinel.mdtools/os_installers/apt.sh
| wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -O "$TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz" | ||
| sudo rm -rf /usr/local/go | ||
| sudo tar -C /usr/local -xzf "$TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz" |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What are the official checksum/signature verification instructions for: Go 1.23.4 linux-amd64 tarball, mikefarah/yq v4.44.6 yq_linux_amd64, and lsd-rs/lsd v1.1.5 amd64.deb?
💡 Result:
Go 1.23.4 linux-amd64 tarball: No evidence found of Go 1.23.4 release as of 2026-04-16; current stable versions are around 1.26.x per https://go.dev/dl/. Check https://go.dev/dl/ for SHA256 checksum listed in table for go1.23.4.linux-amd64.tar.gz if released, or download go1.23.4.linux-amd64.tar.gz.sha256 from storage.googleapis.com/golang/. mikefarah/yq v4.44.6 yq_linux_amd64: Download from https://github.com/mikefarah/yq/releases/tag/v4.44.6. Download 'checksums' and 'checksums_hashes_order' files. Use extract-checksum.sh script: ./extract-checksum.sh SHA-256 yq_linux_amd64 | sha256sum -c. For signature (recent releases): cosign verify-blob --bundle checksums.bundle checksums (install cosign first). lsd-rs/lsd v1.1.5 amd64.deb: Download lsd_1.1.5_amd64.deb from https://github.com/lsd-rs/lsd/releases/tag/v1.1.5. No official checksums or signatures provided in release assets or docs; verify via GitHub release integrity or compute your own SHA256.
Citations:
- 1: https://go.dev/dl/
- 2: Provide download for checksum of go releases. golang/go#68282
- 3: https://tip.golang.org/dl/
- 4: https://go.dev/doc/install
- 5: https://github.com/mikefarah/yq/releases
- 6: https://github.com/mikefarah/yq/blob/master/scripts/extract-checksum.sh
- 7: mikefarah/yq@c8f6c1a
- 8: https://github.com/lsd-rs/lsd/releases/tag/v1.1.5
- 9: https://github.com/mikefarah/yq/releases/tag/v4.44.6
🏁 Script executed:
sed -n '205,260p' tools/os_installers/apt.shRepository: kidchenko/dotfiles
Length of output: 2070
Add artifact integrity verification before privileged install steps for Go and yq.
Downloads are installed via sudo without checksum/signature verification. A compromised release artifact would be executed as root.
Go 1.23.4 and yq v4.44.6 have official checksums available and should be verified before installation:
- Go: SHA256 checksum available at https://go.dev/dl/ or download
go1.23.4.linux-amd64.tar.gz.sha256 - yq: Checksums available in GitHub release assets; use the provided
checksumsfile withsha256sum -corcosign verify-blobfor signature verification
🔐 Suggested hardening pattern (Go example)
(
TMP_DIR=$(mktemp -d)
trap 'rm -rf "$TMP_DIR"' EXIT
GO_VERSION="1.23.4"
+ GO_SHA256="<official_sha256_from_go.dev>"
wget "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -O "$TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz"
+ echo "${GO_SHA256} $TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz" | sha256sum -c -
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf "$TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz"
)Apply similar verification to yq release assets.
Note: lsd v1.1.5 does not provide official checksums or signatures in release assets. Consider verifying via GitHub release integrity or evaluating if signature verification is available elsewhere before sudo dpkg -i.
Also applies to lines 240-242 (yq), 253-254 (lsd).
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@tools/os_installers/apt.sh` around lines 211 - 213, The install steps
download Go and yq into TMP_DIR using wget and then run privileged installs (tar
into /usr/local and dpkg -i for yq/lsd); modify the sequence in the functions or
script block that uses GO_VERSION, TMP_DIR and the yq download lines to first
fetch the corresponding checksum/signature artifact (Go .sha256 or
go<version>.linux-amd64.tar.gz.sha256 and yq's checksums/signature), verify the
downloaded file with sha256sum -c (or cosign verify-blob if a signature is
available) and only proceed to sudo tar -C /usr/local -xzf
"$TMP_DIR/go${GO_VERSION}.linux-amd64.tar.gz" or sudo dpkg -i for yq/lsd when
verification succeeds; for lsd note that no official checksum may exist so
either skip privileged install until integrity method is available or validate
via GitHub release provenance before invoking sudo dpkg -i.
1 participant
🚨 Severity: HIGH
💡 Vulnerability: The
tools/os_installers/apt.shscript was downloading executable artifacts to predictable temporary paths like/tmp/yqor directly to the current working directory. This pattern is vulnerable to Time-of-Check to Time-of-Use (TOCTOU) and symlink attacks. If an attacker pre-creates a symlink at/tmp/yqpointing to a sensitive file, the script (running withsudo) could inadvertently overwrite it or allow local privilege escalation.🎯 Impact: Local attackers could potentially escalate privileges or overwrite critical system files by exploiting the predictable download paths when the installation script is executed.
🔧 Fix: Wrapped the
go,yq, andlsdinstallation blocks in subshells(...). Within each subshell, a secure temporary directory is created usingTMP_DIR=$(mktemp -d), and a local trap (trap 'rm -rf "$TMP_DIR"' EXIT) ensures cleanup. Thewgetcommands were updated to download specifically into this isolated directory.✅ Verification: Ensure the scripts pass
shellcheck(via./build.sh lint) and that running the modified installation blocks does not leave artifacts in/tmpor the current directory.PR created automatically by Jules for task 10068104001288958326 started by @kidchenko
Summary by CodeRabbit
Documentation
Chores