Skip to content

security: verify integrity of downloaded scripts before execution #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jacobtomlinson merged 1 commit into from
Mar 17, 2026
Merged

security: verify integrity of downloaded scripts before execution #106

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,29 @@ install_nodejs() {
fi

info "Node.js not found — installing via nvm…"
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.4/install.sh | bash
# IMPORTANT: update NVM_SHA256 when changing NVM_VERSION
local NVM_VERSION="v0.40.4"
local NVM_SHA256="4b7412c49960c7d31e8df72da90c1fb5b8cccb419ac99537b737028d497aba4f"
local nvm_tmp
nvm_tmp="$(mktemp)"
curl -fsSL "https://raw.githubusercontent.com/nvm-sh/nvm/${NVM_VERSION}/install.sh" -o "$nvm_tmp" \
|| { rm -f "$nvm_tmp"; error "Failed to download nvm installer"; }
local actual_hash
if command_exists sha256sum; then
actual_hash="$(sha256sum "$nvm_tmp" | awk '{print $1}')"
elif command_exists shasum; then
actual_hash="$(shasum -a 256 "$nvm_tmp" | awk '{print $1}')"
else
warn "No SHA-256 tool found — skipping nvm integrity check"
actual_hash="$NVM_SHA256" # allow execution
fi
if [[ "$actual_hash" != "$NVM_SHA256" ]]; then
rm -f "$nvm_tmp"
error "nvm installer integrity check failed\n Expected: $NVM_SHA256\n Actual: $actual_hash"
fi
info "nvm installer integrity verified"
bash "$nvm_tmp"
rm -f "$nvm_tmp"
ensure_nvm_loaded
nvm install 24
info "Node.js installed: $(node --version)"
Expand Down