Skip to content

fix(security): harden self-update with tagged refs + SHA-256 verification [DEVA11Y-478] #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sunny-se wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(security): harden self-update with tagged refs + SHA-256 verification [DEVA11Y-478] #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions scripts/SHA256SUMS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
6d1569318fb07fe4319b88dd129c78953e6a66ebc39f98bd24ec73a121d4fc1e bash/cli.sh
5754120729dc9e503b7454419fd243297e3392cd57e459f3efe29f06f3c78c2d bash/spm.sh
559b757e67f1057f329911a7ce21cadb9637858bfab4192c673ecd6898f7ab47 fish/cli.sh
929e1418b3e09fc72577dc8e8d62f1fc585e7538ec4f720c0b596e2ab7df2e34 fish/spm.sh
16f67393c7f036a88f25fccd647cfbf286718f0792b7c4accb49adc620168976 zsh/cli.sh
f9c450e90c1f7b1917ef2106d04df7d02775465af1052ba14b211550125000aa zsh/spm.sh
39 changes: 35 additions & 4 deletions scripts/bash/cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/usr/bin/env bash -il
SCRIPT_VERSION="v1.0.0"

GIT_ROOT=$(git rev-parse --show-toplevel 2>/dev/null)
SCRIPT_PATH=$(realpath --relative-to="$GIT_ROOT" "$0" 2>/dev/null || realpath "$0")
Expand Down Expand Up @@ -79,12 +80,42 @@ a11y_scan() {
}

script_self_update() {
local remote_url="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools/refs/heads/main/scripts/bash/cli.sh"
local repo_base="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools"
local version_url="${repo_base}/refs/heads/main/scripts/latest-version.txt"
local script_rel_path="bash/cli.sh"

updated_script=$(curl -R -z "$SCRIPT_PATH" "$remote_url")
if [[ $updated_script =~ ^#! ]]; then
echo "$updated_script" > "$SCRIPT_PATH"
# Fetch remote version (lightweight metadata from main, not executable code)
local remote_version
remote_version=$(curl -fsSL --max-time 10 "$version_url" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$remote_version" || "$remote_version" == "$SCRIPT_VERSION" ]]; then
return 0
fi

# Fetch script and checksums from immutable tagged ref
local tag_base="${repo_base}/refs/tags/${remote_version}/scripts"
local tmp_script tmp_sums
tmp_script=$(mktemp)
tmp_sums=$(mktemp)
trap 'rm -f "$tmp_script" "$tmp_sums"' RETURN

if ! curl -fsSL --max-time 30 "${tag_base}/${script_rel_path}" -o "$tmp_script" 2>/dev/null; then
return 0
fi
if ! curl -fsSL --max-time 10 "${tag_base}/SHA256SUMS" -o "$tmp_sums" 2>/dev/null; then
return 0
fi

# Verify SHA-256 checksum
local expected actual
expected=$(grep " ${script_rel_path}$" "$tmp_sums" | cut -d' ' -f1)
actual=$(shasum -a 256 "$tmp_script" | cut -d' ' -f1)
if [[ -z "$expected" || "$actual" != "$expected" ]]; then
echo "[self-update] WARNING: Checksum verification failed for ${script_rel_path}. Update aborted." >&2
return 1
fi

cp "$tmp_script" "$0"
echo "[self-update] Updated to ${remote_version}." >&2
}

download_binary() {
Expand Down
39 changes: 35 additions & 4 deletions scripts/bash/spm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/usr/bin/env bash -il
SCRIPT_VERSION="v1.0.0"

[ -f "${PWD}/Package.swift" ]
PACKAGE_EXISTS="$?"
Expand Down Expand Up @@ -84,12 +85,42 @@ EOF
}

script_self_update() {
local remote_url="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools/refs/heads/main/scripts/bash/spm.sh"
local repo_base="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools"
local version_url="${repo_base}/refs/heads/main/scripts/latest-version.txt"
local script_rel_path="bash/spm.sh"

updated_script=$(curl -R -z "$SCRIPT_PATH" "$remote_url")
if [[ $updated_script =~ ^#! ]]; then
echo "$updated_script" > "$SCRIPT_PATH"
# Fetch remote version (lightweight metadata from main, not executable code)
local remote_version
remote_version=$(curl -fsSL --max-time 10 "$version_url" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$remote_version" || "$remote_version" == "$SCRIPT_VERSION" ]]; then
return 0
fi

# Fetch script and checksums from immutable tagged ref
local tag_base="${repo_base}/refs/tags/${remote_version}/scripts"
local tmp_script tmp_sums
tmp_script=$(mktemp)
tmp_sums=$(mktemp)
trap 'rm -f "$tmp_script" "$tmp_sums"' RETURN

if ! curl -fsSL --max-time 30 "${tag_base}/${script_rel_path}" -o "$tmp_script" 2>/dev/null; then
return 0
fi
if ! curl -fsSL --max-time 10 "${tag_base}/SHA256SUMS" -o "$tmp_sums" 2>/dev/null; then
return 0
fi

# Verify SHA-256 checksum
local expected actual
expected=$(grep " ${script_rel_path}$" "$tmp_sums" | cut -d' ' -f1)
actual=$(shasum -a 256 "$tmp_script" | cut -d' ' -f1)
if [[ -z "$expected" || "$actual" != "$expected" ]]; then
echo "[self-update] WARNING: Checksum verification failed for ${script_rel_path}. Update aborted." >&2
return 1
fi

cp "$tmp_script" "$0"
echo "[self-update] Updated to ${remote_version}." >&2
}

script_self_update
Expand Down
39 changes: 35 additions & 4 deletions scripts/fish/cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/usr/bin/env bash -il
SCRIPT_VERSION="v1.0.0"

export PATH="$PATH:/opt/homebrew/bin"
# Shell specific
Expand Down Expand Up @@ -91,12 +92,42 @@ a11y_scan() {
}

script_self_update() {
local remote_url="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools/refs/heads/main/scripts/fish/cli.sh"
local repo_base="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools"
local version_url="${repo_base}/refs/heads/main/scripts/latest-version.txt"
local script_rel_path="fish/cli.sh"

# Fetch remote version (lightweight metadata from main, not executable code)
local remote_version
remote_version=$(curl -fsSL --max-time 10 "$version_url" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$remote_version" || "$remote_version" == "$SCRIPT_VERSION" ]]; then
return 0
fi

# Fetch script and checksums from immutable tagged ref
local tag_base="${repo_base}/refs/tags/${remote_version}/scripts"
local tmp_script tmp_sums
tmp_script=$(mktemp)
tmp_sums=$(mktemp)
trap 'rm -f "$tmp_script" "$tmp_sums"' RETURN

if ! curl -fsSL --max-time 30 "${tag_base}/${script_rel_path}" -o "$tmp_script" 2>/dev/null; then
return 0
fi
if ! curl -fsSL --max-time 10 "${tag_base}/SHA256SUMS" -o "$tmp_sums" 2>/dev/null; then
return 0
fi

updated_script=$(curl -R -z "$SCRIPT_PATH" "$remote_url")
if [[ $updated_script =~ ^#! ]]; then
echo "$updated_script" > "$SCRIPT_PATH"
# Verify SHA-256 checksum
local expected actual
expected=$(grep " ${script_rel_path}$" "$tmp_sums" | cut -d' ' -f1)
actual=$(shasum -a 256 "$tmp_script" | cut -d' ' -f1)
if [[ -z "$expected" || "$actual" != "$expected" ]]; then
echo "[self-update] WARNING: Checksum verification failed for ${script_rel_path}. Update aborted." >&2
return 1
fi

cp "$tmp_script" "$0"
echo "[self-update] Updated to ${remote_version}." >&2
}

download_binary() {
Expand Down
39 changes: 35 additions & 4 deletions scripts/fish/spm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/usr/bin/env bash -il
SCRIPT_VERSION="v1.0.0"

export PATH="$PATH:/opt/homebrew/bin"
# Shell specific
Expand Down Expand Up @@ -97,12 +98,42 @@ EOF
}

script_self_update() {
local remote_url="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools/refs/heads/main/scripts/fish/spm.sh"
local repo_base="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools"
local version_url="${repo_base}/refs/heads/main/scripts/latest-version.txt"
local script_rel_path="fish/spm.sh"

updated_script=$(curl -R -z "$SCRIPT_PATH" "$remote_url")
if [[ $updated_script =~ ^#! ]]; then
echo "$updated_script" > "$SCRIPT_PATH"
# Fetch remote version (lightweight metadata from main, not executable code)
local remote_version
remote_version=$(curl -fsSL --max-time 10 "$version_url" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$remote_version" || "$remote_version" == "$SCRIPT_VERSION" ]]; then
return 0
fi

# Fetch script and checksums from immutable tagged ref
local tag_base="${repo_base}/refs/tags/${remote_version}/scripts"
local tmp_script tmp_sums
tmp_script=$(mktemp)
tmp_sums=$(mktemp)
trap 'rm -f "$tmp_script" "$tmp_sums"' RETURN

if ! curl -fsSL --max-time 30 "${tag_base}/${script_rel_path}" -o "$tmp_script" 2>/dev/null; then
return 0
fi
if ! curl -fsSL --max-time 10 "${tag_base}/SHA256SUMS" -o "$tmp_sums" 2>/dev/null; then
return 0
fi

# Verify SHA-256 checksum
local expected actual
expected=$(grep " ${script_rel_path}$" "$tmp_sums" | cut -d' ' -f1)
actual=$(shasum -a 256 "$tmp_script" | cut -d' ' -f1)
if [[ -z "$expected" || "$actual" != "$expected" ]]; then
echo "[self-update] WARNING: Checksum verification failed for ${script_rel_path}. Update aborted." >&2
return 1
fi

cp "$tmp_script" "$0"
echo "[self-update] Updated to ${remote_version}." >&2
}

script_self_update
Expand Down
1 change: 1 addition & 0 deletions scripts/latest-version.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
v1.0.0
39 changes: 35 additions & 4 deletions scripts/zsh/cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/usr/bin/env bash -il
SCRIPT_VERSION="v1.0.0"

# Shell specific
zsh_bin=$(command -v zsh)
Expand Down Expand Up @@ -90,12 +91,42 @@ a11y_scan() {
}

script_self_update() {
local remote_url="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools/refs/heads/main/scripts/zsh/cli.sh"
local repo_base="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools"
local version_url="${repo_base}/refs/heads/main/scripts/latest-version.txt"
local script_rel_path="zsh/cli.sh"

# Fetch remote version (lightweight metadata from main, not executable code)
local remote_version
remote_version=$(curl -fsSL --max-time 10 "$version_url" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$remote_version" || "$remote_version" == "$SCRIPT_VERSION" ]]; then
return 0
fi

# Fetch script and checksums from immutable tagged ref
local tag_base="${repo_base}/refs/tags/${remote_version}/scripts"
local tmp_script tmp_sums
tmp_script=$(mktemp)
tmp_sums=$(mktemp)
trap 'rm -f "$tmp_script" "$tmp_sums"' RETURN

if ! curl -fsSL --max-time 30 "${tag_base}/${script_rel_path}" -o "$tmp_script" 2>/dev/null; then
return 0
fi
if ! curl -fsSL --max-time 10 "${tag_base}/SHA256SUMS" -o "$tmp_sums" 2>/dev/null; then
return 0
fi

updated_script=$(curl -R -z "$SCRIPT_PATH" "$remote_url")
if [[ $updated_script =~ ^#! ]]; then
echo "$updated_script" > "$SCRIPT_PATH"
# Verify SHA-256 checksum
local expected actual
expected=$(grep " ${script_rel_path}$" "$tmp_sums" | cut -d' ' -f1)
actual=$(shasum -a 256 "$tmp_script" | cut -d' ' -f1)
if [[ -z "$expected" || "$actual" != "$expected" ]]; then
echo "[self-update] WARNING: Checksum verification failed for ${script_rel_path}. Update aborted." >&2
return 1
fi

cp "$tmp_script" "$0"
echo "[self-update] Updated to ${remote_version}." >&2
}

download_binary() {
Expand Down
39 changes: 35 additions & 4 deletions scripts/zsh/spm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/usr/bin/env bash -il
SCRIPT_VERSION="v1.0.0"

# Shell specific
zsh_bin=$(command -v zsh)
Expand Down Expand Up @@ -96,12 +97,42 @@ EOF
}

script_self_update() {
local remote_url="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools/refs/heads/main/scripts/zsh/spm.sh"
local repo_base="https://raw.githubusercontent.com/browserstack/AccessibilityDevTools"
local version_url="${repo_base}/refs/heads/main/scripts/latest-version.txt"
local script_rel_path="zsh/spm.sh"

updated_script=$(curl -R -z "$SCRIPT_PATH" "$remote_url")
if [[ $updated_script =~ ^#! ]]; then
echo "$updated_script" > "$SCRIPT_PATH"
# Fetch remote version (lightweight metadata from main, not executable code)
local remote_version
remote_version=$(curl -fsSL --max-time 10 "$version_url" 2>/dev/null | tr -d '[:space:]')
if [[ -z "$remote_version" || "$remote_version" == "$SCRIPT_VERSION" ]]; then
return 0
fi

# Fetch script and checksums from immutable tagged ref
local tag_base="${repo_base}/refs/tags/${remote_version}/scripts"
local tmp_script tmp_sums
tmp_script=$(mktemp)
tmp_sums=$(mktemp)
trap 'rm -f "$tmp_script" "$tmp_sums"' RETURN

if ! curl -fsSL --max-time 30 "${tag_base}/${script_rel_path}" -o "$tmp_script" 2>/dev/null; then
return 0
fi
if ! curl -fsSL --max-time 10 "${tag_base}/SHA256SUMS" -o "$tmp_sums" 2>/dev/null; then
return 0
fi

# Verify SHA-256 checksum
local expected actual
expected=$(grep " ${script_rel_path}$" "$tmp_sums" | cut -d' ' -f1)
actual=$(shasum -a 256 "$tmp_script" | cut -d' ' -f1)
if [[ -z "$expected" || "$actual" != "$expected" ]]; then
echo "[self-update] WARNING: Checksum verification failed for ${script_rel_path}. Update aborted." >&2
return 1
fi

cp "$tmp_script" "$0"
echo "[self-update] Updated to ${remote_version}." >&2
}

script_self_update
Expand Down
Loading