Authenticated Downloads #2
Assignees
Labels
Comments
It’s just a bunch of chained together shell commands. I want to take a download URL and automatically try and pull the additional Download file from URL > pull additional file
|
|
Do you have any test cases set up?
(ie: passing files, and failing files)?
This SEEMS to be relatively straightfoward. I'm wondering if there's
something I'm missing, it seems so easy :)
writing off the cuff, non tested:
function getsecurefile()
{
# cd to appropriate directory
wget -q $1
wget -q {$1}.minisig
fname=`basename $`
if minisign -Vm $fname -P PasswordHere >/dev/null ; then
# echo DEBUG: downloaded valid file $fname
return 0
fi
# File failed signature check ....
# echo DEBUG: downloaded file $fname failed signature check
mv $$1 $1.minisig /tmp
return 1
}
|
|
I’ll make some test files for you either late tonight or tomorrow. If you
want you can check out my unofficial ‘Markdeep’ repo, because everything is
signed with that minisign key. Just modify one file and it won’t verify.
…--
PGP:5EC1494DC59141C0
On Oct 29, 2017, at 07:25, ppbrown <notifications@github.com> wrote:
Do you have any test cases set up?
(ie: passing files, and failing files)?
This SEEMS to be relatively straightfoward. I'm wondering if there's
something I'm missing, it seems so easy :)
writing off the cuff, non tested:
function getsecurefile()
{
# cd to appropriate directory
wget -q $1
wget -q {$1}.minisig
fname=`basename $`
if minisign -Vm $fname -P PasswordHere >/dev/null ; then
# echo DEBUG: downloaded valid file $fname
return 0
fi
# File failed signature check ....
# echo DEBUG: downloaded file $fname failed signature check
mv $$1 $1.minisig /tmp
return 1
}
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#2 (comment)>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/AFYisUN6r_Ge_cUHP-3xX6pTtJNivgBIks5sxIrsgaJpZM4P84io>
.
|
|
Is that function I sent, basically all you were looking for?
On Sun, Oct 29, 2017 at 2:35 PM, Bryan Black <notifications@github.com>
wrote:
… I’ll make some test files for you either late tonight or tomorrow. If you
want you can check out my unofficial ‘Markdeep’ repo, because everything is
signed with that minisign key. Just modify one file and it won’t verify.
--
PGP:5EC1494DC59141C0
On Oct 29, 2017, at 07:25, ppbrown ***@***.***> wrote:
Do you have any test cases set up?
(ie: passing files, and failing files)?
This SEEMS to be relatively straightfoward. I'm wondering if there's
something I'm missing, it seems so easy :)
writing off the cuff, non tested:
function getsecurefile()
{
# cd to appropriate directory
wget -q $1
wget -q {$1}.minisig
fname=`basename $`
if minisign -Vm $fname -P PasswordHere >/dev/null ; then
# echo DEBUG: downloaded valid file $fname
return 0
fi
# File failed signature check ....
# echo DEBUG: downloaded file $fname failed signature check
mv $$1 $1.minisig /tmp
return 1
}
—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
<#2 (comment)>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/AFYisUN6r_Ge_cUHP-
3xX6pTtJNivgBIks5sxIrsgaJpZM4P84io>
.
—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
<#2 (comment)>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/ABpK-Zz3zNLXJ3ruWRoPF2LBfkOjRk70ks5sxO-mgaJpZM4P84io>
.
|
|
Yes, that's basically what I'm looking for. Hopefully it will be an ever-green one-trick-pony that's a no-brainer to use so more people can use it in their projects for file authentication. The test files. http://mutualparity.s3.amazonaws.com/test/fail.min.js |
|
k. well, give it a try yourself and lemme know
…On Mon, Oct 30, 2017 at 7:32 PM, Bryan Black ***@***.***> wrote:
Yes, that's basically what I'm looking for. Hopefully it will be an
*ever-green* one-trick-pony that's a no-brainer to use so more people can
use it in their projects for file authentication.
------------------------------
The test files.
http://mutualparity.s3.amazonaws.com/test/fail.min.js
http://mutualparity.s3.amazonaws.com/test/fail.min.js.minisig
http://mutualparity.s3.amazonaws.com/test/pass.min.js
http://mutualparity.s3.amazonaws.com/test/pass.min.js.minisig
—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
<#2 (comment)>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/ABpK-QJkCVzR4ylXzmxp-KDKOt3mHxhuks5sxobKgaJpZM4P84io>
.
|
|
I'm trying to figure out how to get it to work as a stand alone shell script for testing purposes:
I run:
It returns:
|
RESOLVED.I managed to get it working by explicitly listing the I couldn't figure out the other way. This will properly PASS and FAIL the simulated files. It's amazing what a little RTFM can do for me... |
|
but;. but... thats ugly :(
seems I made a typo.
not supposed to be {$1}
was supposed to be ${1}
try that, and it will probbly work.
Anyways, if youre happy with that, thats great. was fairly trivial for me.
not even an hour's effort.
So, if you like, just send a few amazon giftcard dollars my way, and I'll
be happy :)
…On Wed, Nov 1, 2017 at 4:50 PM, Bryan Black ***@***.***> wrote:
*RESOLVED.*
I managed to get it working by explicitly listing the .minisig URL.
#!/bin/bash
function getsecurefile() {
# cd to appropriate directory
wget -q $1
wget -q $2
fname=`basename $1`
if minisign -Vm $fname -P RWSmY4o5Bad1vS60aYAiQUswWYVV2EuSdqc3ry7CWWF1E6bVbFG9kR/y >/dev/null ; then
echo DEBUG: downloaded valid file $fname
return 0
fi
# File failed signature check ....
echo DEBUG: downloaded file $fname failed signature check
mv $fname $fname.minisig /tmp
return 1
}
getsecurefile http://mutualparity.s3.amazonaws.com/test/fail.min.js http://mutualparity.s3.amazonaws.com/test/fail.min.js.minisig
It's amazing what a little RTFM can do for me...
<https://camo.githubusercontent.com/179d8ee432308af184f707e92643cba1e6bba894/687474703a2f2f692e696d6775722e636f6d2f74387a76632e676966>
—
You are receiving this because you were assigned.
Reply to this email directly, view it on GitHub
<#2 (comment)>, or mute the
thread
<https://github.com/notifications/unsubscribe-auth/ABpK-XTVyMn9RWDxqArSgZelffMw7GcEks5syQPKgaJpZM4P84io>
.
|
|
Payment sent. Thank you.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Introduction
4S needs to verify its authenticity when it downloads an update. If the update fails to be signed by the signing key it should move the inauthentic file to
/tmpand print an error.Simulate a 4S Alias User.
I setup a virtual machine with a fresh Ubuntu Desktop install and I snapshot it with a Terminal window open and a browser window with the instructions open. That way I can rapidly restore to that snapshot over and over for testing on a vanilla install.
💾📖 Ubuntu Setup Step-by-Step
I've had problems with the
linuxbrew-wrapperpackage in the Ubuntu repos, so I install brew with the instructions on the website. I'll have to submit a bug report to fixlinuxbrew-wrapper.Here are the steps taken on the website:
Copy & paste to install brew dependencies + brew + brew aliases all at once.
Then install minisign:
brew install minisignInstall the 4S alias files.
💾⚠️ Or, Ubuntu setup in 1 copy & paste
That was fast... 🏁
Goal
Email Context:
As you can see in the code snippet below. This
4s-updatealias is just tellingwgetto override its self and then reloading the shell to use the latest changes.4S/ubuntu-bash/.4s-index
Lines 14 to 16 in 937f966
I would like these update aliases to automatically verify with
minisign. For the sake of making things look clean I would like it to be a shell script subroutine that gets called from the alias. But if that's not possible, that's your call.The text was updated successfully, but these errors were encountered: