Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

curl | bash is bad... because: #127

Open
TJM opened this issue Sep 14, 2016 · 3 comments
Open

curl | bash is bad... because: #127

TJM opened this issue Sep 14, 2016 · 3 comments

Comments

@TJM
Copy link

TJM commented Sep 14, 2016

The command:

      command     => "curl -fsSL https://get.rvm.io | bash -s -- --version ${actual_version}",

Will not detect a failure in "curl" ... recently there was an issue with the get.rvm.io SSL certificate, and the rvm-system continued on its merry way because "bash" received an "empty file." Anything that uses RVM beyond that will fail because "rvm" doesn't exist. I would recommend separating the curl command from the bash command, or at least prefixing the command with set -o pipefail;.

~tommy

@Hoodoo
Copy link

Hoodoo commented Nov 30, 2016

Not only that. The script is passed to bash without verification. Verification happens only if the script calls for it. It should be curl - gnupg - bash.

@TJM
Copy link
Author

TJM commented Nov 30, 2016

Wow, resurrection... I was trying desperately to ignore the "safety" and focus strictly on functionality (or lack there of). NOTE: The SSL issue with get.rvm.io was quickly resolved after asking in IRC, so at least it was a temporary issue, but it did highlight an issue.

Tommy

@Hoodoo
Copy link

Hoodoo commented Dec 1, 2016

Here's what I came up with. I can't risk running it as it is, so the fix might be ugly but it stays in my setup

#133

It works with 1.13.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants