search

voxpupuli / puppet-rvm

A puppet module for installing and using RVM (Ruby Version Manager)
https://forge.puppet.com/puppet/rvm
BSD 3-Clause "New" or "Revised" License
32 stars 102 forks source link

curl | bash is bad... because: #127

Open TJM opened 7 years ago

TJM commented 7 years ago

The command:

      command     => "curl -fsSL https://get.rvm.io | bash -s -- --version ${actual_version}",

Will not detect a failure in "curl" ... recently there was an issue with the get.rvm.io SSL certificate, and the rvm-system continued on its merry way because "bash" received an "empty file." Anything that uses RVM beyond that will fail because "rvm" doesn't exist. I would recommend separating the curl command from the bash command, or at least prefixing the command with set -o pipefail;.

~tommy

Hoodoo commented 7 years ago

Not only that. The script is passed to bash without verification. Verification happens only if the script calls for it. It should be curl - gnupg - bash.

TJM commented 7 years ago

Wow, resurrection... I was trying desperately to ignore the "safety" and focus strictly on functionality (or lack there of). NOTE: The SSL issue with get.rvm.io was quickly resolved after asking in IRC, so at least it was a temporary issue, but it did highlight an issue.

Tommy

Hoodoo commented 7 years ago

Here's what I came up with. I can't risk running it as it is, so the fix might be ugly but it stays in my setup

https://github.com/maestrodev/puppet-rvm/pull/133

It works with 1.13.1