bootstrap: verify fetched archinstall.json before running it #1

Merged
flan merged 1 commits from fix/verify-fetched-config into master 2026-07-19 16:07:38 -04:00
Owner

Closes repo-review finding 1e6e103daf88.

bootstrap.sh fetched archinstall.json over HTTPS with no integrity check. Its custom-commands run as root during install, so a config poisoned by a compromised mirror was root RCE — TLS authenticates the transport, not the upstream. The config is now verified before the @@BASE@@ substitution:

  • default: SHA-256 pinned in the script (kept in lockstep with the config). ARCH_TURNKEY_CONFIG_SHA256 overrides it (needed for a fork with a different config); =skip opts out. Catches drift, truncation, and a mirror poisoning only the config.
  • ARCH_TURNKEY_PUBKEY: require + verify a detached GPG signature (configs/archinstall.json.sig) against an out-of-band key — the only mode that resists a fully compromised upstream.

README + CHANGELOG document both knobs. Verified: correct config passes, tampered aborts, skip bypasses, and the GPG good/bad-sig paths behave.

Closes repo-review finding **`1e6e103daf88`**. `bootstrap.sh` fetched `archinstall.json` over HTTPS with no integrity check. Its custom-commands run as root during install, so a config poisoned by a compromised mirror was root RCE — TLS authenticates the transport, not the upstream. The config is now verified **before** the `@@BASE@@` substitution: - **default:** SHA-256 pinned in the script (kept in lockstep with the config). `ARCH_TURNKEY_CONFIG_SHA256` overrides it (needed for a fork with a different config); `=skip` opts out. Catches drift, truncation, and a mirror poisoning only the config. - **`ARCH_TURNKEY_PUBKEY`:** require + verify a detached GPG signature (`configs/archinstall.json.sig`) against an out-of-band key — the only mode that resists a fully compromised upstream. README + CHANGELOG document both knobs. Verified: correct config passes, tampered aborts, `skip` bypasses, and the GPG good/bad-sig paths behave.
flan added 1 commit 2026-07-19 16:04:47 -04:00
The config's custom-commands run as root during install, so a config poisoned
by a compromised mirror was root RCE — TLS covers the transport, not the
upstream. Verify it before the @@BASE@@ substitution:

- default: SHA-256 pinned in the script (kept in lockstep with the config);
  ARCH_TURNKEY_CONFIG_SHA256 overrides it, =skip opts out. Catches drift,
  truncation, and a mirror poisoning only the config.
- ARCH_TURNKEY_PUBKEY: require + verify a detached GPG signature
  (configs/archinstall.json.sig) against an out-of-band key — the only mode
  that resists a fully compromised upstream.

Document both knobs in the README and CHANGELOG.
flan merged commit c6508c7131 into master 2026-07-19 16:07:38 -04:00
flan deleted branch fix/verify-fetched-config 2026-07-19 16:07:38 -04:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: flan/arch-turnkey#1