mxcl/homebrew — Issue #10199: Patching from URLs without checksums is a bad idea
Author: dhess
Created: 2012-02-15 10:30:57+00:00
State: open

Patching upstream source from URLs, without doing a checksum to verify the contents of the URL, is a security issue waiting to happen.

For example, the Emacs brew grabs several patches from various gists. If someone were to replace the contents of one of those gists with malicious code, he could easily trojan Homebrew Emacs. I doubt that anyone who installs the Emacs brew bothers to look at the contents of the patches after the first time (if even then).

The Homebrew maintainers correctly quashed any notion of disabling checksumming for source tarballs in #9656. The same arguments apply to patches. Brews that apply patches should either inline the patch (preferable, in my opinion, unless the patch is large), or checksum a patch downloaded from a URL before applying it.

Patches applied from raw gists and gitweb services can mitigate the risk by linking to a specific version of the gist, with the sha1 appended to the URL. This still places all the trust in the server serving the content, which isn't ideal, but it's low-hanging fruit, and would be a good start for all the brews that patch from gists (most already link to the sha1 URLs, anyway). But I think the ultimate solution should be an official brew patch mechanism that requires client-verified checksums on downloaded patches.