Cryptographic Integrity and Authentication Validation of Homebrew Installer?
4
votes
1
answer
336
views
Is there a way to install homebrew on MacOS such that anything downloaded from the Internet is cryptographically validated for integrity and authenticated to the actual publisher?
Unfortunately, the method listed on the official brew.sh website to install it on MacOS is a horribly insecure curl-piped-to-bash command
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install.sh) "
> **Note that https doesn't provide authentication** since X.509 checks in curl
trusts a *ton* of certificates (including certs issued by CAs owned by Nation States that have known history of committing cyber attacks, including active content manipulation over https via MITM attacks)
Ideally, these cryptographic checks would come in the form of a signed checksum file using gpg
.
Is there any way to install brew
in a way that provides cryptographic validation of the installer's integrity and authenticity?
Asked by Michael Altfield
(745 rep)
Jun 21, 2020, 01:38 PM
Last activity: Jun 21, 2020, 01:52 PM
Last activity: Jun 21, 2020, 01:52 PM