Security enhancements and script hardening improvements - #3
Open
jokerowicz wants to merge 7 commits into
Open
Conversation
- Force HTTPS protocol for SF_URL to prevent potential Man-in-the-Middle (MitM) attacks during package downloads. - Add automatic MD5 checksum verification (md5sum -w -c) right after pulling packages or packages list. - Quote shell variables properly to avoid word splitting and path-related issues.
- Add error checking for filesystem mounts (/proc, /sys, /dev/pts) to fail fast on critical setup errors. - Secure environment variables and paths with proper quoting to prevent word splitting. - Add conditional checks for udevd and sshd binaries before execution, along with automated ssh-keygen host keys generation.
- Quote all directory and path variables to prevent word splitting issues. - Add error checking for directory creation and verify template file existence before processing. - Make script exit safely when required parameters or templates are missing.
- Enable pipefail option to catch errors across command pipelines properly. - Quote package name and output PDF variables to prevent word splitting issues. - Add safety checks for evince and graphical display availability before attempting to open the PDF.
- Add error checking for filesystem mounts (/proc, /sys, /dev/pts) to fail fast on critical setup errors. - Secure environment variables and paths with proper quoting to prevent word splitting. - Add conditional checks for udevd and sshd binaries before execution, along with automated ssh-keygen host keys generation.
- Quote all variables and paths to prevent word splitting issues. - Add existence checks for target directories and user configuration files. - Improve robustness of archiving, checksum generation, and scp upload loops.
Quote all directory and path variables to prevent word splitting issues. Add error checking for directory creation and verify template file existence before processing. Make script exit safely when required parameters or templates are missing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces comprehensive security enhancements and robustness improvements across several builder and system scripts: