bootstrap.sh fetched archinstall.json over HTTPS with no integrity check. Its custom-commands run as root during install, so a config poisoned by a compromised mirror was root RCE — TLS authenticates the transport, not the upstream. The config is now verified before the @@BASE@@ substitution:
default: SHA-256 pinned in the script (kept in lockstep with the config). ARCH_TURNKEY_CONFIG_SHA256 overrides it (needed for a fork with a different config); =skip opts out. Catches drift, truncation, and a mirror poisoning only the config.
ARCH_TURNKEY_PUBKEY: require + verify a detached GPG signature (configs/archinstall.json.sig) against an out-of-band key — the only mode that resists a fully compromised upstream.
README + CHANGELOG document both knobs. Verified: correct config passes, tampered aborts, skip bypasses, and the GPG good/bad-sig paths behave.
Closes repo-review finding **`1e6e103daf88`**.
`bootstrap.sh` fetched `archinstall.json` over HTTPS with no integrity check. Its custom-commands run as root during install, so a config poisoned by a compromised mirror was root RCE — TLS authenticates the transport, not the upstream. The config is now verified **before** the `@@BASE@@` substitution:
- **default:** SHA-256 pinned in the script (kept in lockstep with the config). `ARCH_TURNKEY_CONFIG_SHA256` overrides it (needed for a fork with a different config); `=skip` opts out. Catches drift, truncation, and a mirror poisoning only the config.
- **`ARCH_TURNKEY_PUBKEY`:** require + verify a detached GPG signature (`configs/archinstall.json.sig`) against an out-of-band key — the only mode that resists a fully compromised upstream.
README + CHANGELOG document both knobs. Verified: correct config passes, tampered aborts, `skip` bypasses, and the GPG good/bad-sig paths behave.
The config's custom-commands run as root during install, so a config poisoned
by a compromised mirror was root RCE — TLS covers the transport, not the
upstream. Verify it before the @@BASE@@ substitution:
- default: SHA-256 pinned in the script (kept in lockstep with the config);
ARCH_TURNKEY_CONFIG_SHA256 overrides it, =skip opts out. Catches drift,
truncation, and a mirror poisoning only the config.
- ARCH_TURNKEY_PUBKEY: require + verify a detached GPG signature
(configs/archinstall.json.sig) against an out-of-band key — the only mode
that resists a fully compromised upstream.
Document both knobs in the README and CHANGELOG.
flan
merged commit c6508c7131 into master2026-07-19 16:07:38 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes repo-review finding
1e6e103daf88.bootstrap.shfetchedarchinstall.jsonover HTTPS with no integrity check. Its custom-commands run as root during install, so a config poisoned by a compromised mirror was root RCE — TLS authenticates the transport, not the upstream. The config is now verified before the@@BASE@@substitution:ARCH_TURNKEY_CONFIG_SHA256overrides it (needed for a fork with a different config);=skipopts out. Catches drift, truncation, and a mirror poisoning only the config.ARCH_TURNKEY_PUBKEY: require + verify a detached GPG signature (configs/archinstall.json.sig) against an out-of-band key — the only mode that resists a fully compromised upstream.README + CHANGELOG document both knobs. Verified: correct config passes, tampered aborts,
skipbypasses, and the GPG good/bad-sig paths behave.