Dockerfile supply chain risks?
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
Research direction
Start by reviewing the Dockerfile commands that pipe curl responses to bash or download release archives and packages. Check how each dependency is currently fetched and determine whether checksum verification can be added consistently; done means the listed downloads validate trusted checksums before execution or installation.
Written by the indexing model from the issue text.
Description
I'm seeing this in the Dockerfile:
RUN curl -fsSL https://claude.ai/install.sh | bash
RUN curl -fsSL https://fnm.vercel.app/install | bash -s -- ...
RUN sh -c "$(curl -fsSL https://github.com/deluan/zsh-in-docker/releases/download/v${ZSH_IN_DOCKER_VERSION}/zsh-i
And these:
curl -fsSL "https://github.com/dandavison/delta/releases/download/${GIT_DELTA_VERSION}/git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" -o /tmp/git-delta.deb
dpkg -i /tmp/git-delta.deb
curl -fsSL "https://github.com/junegunn/fzf/releases/download/v${FZF_VERSION}/fzf-${FZF_VERSION}-${FZF_ARCH}.tar.gz" | t
All of those seem like supply-chain risks. I would love to see this with checksum verification, if feasible. Given that you're security experts, I'm assuming I'm looking at this wrong, but I wanted to raise the issue and be sure. I am not a security expert.
- Dominant language
- Shell
- Stars
- 945
- Forks
- 103
- Avg merge
- 47m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from trailofbits/claude-code-devcontainer
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
trailofbits/claude-code-devcontainer#36 · 1 comment · 2 reactions ·
All issues in trailofbits/claude-code-devcontainer
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
YosysHQ/oss-cad-suite-build#216 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
ekalinin/github-markdown-toc#167 ·
-
out-of-date
Difficulty 1/5 Under an hour Newbie friendliness 82/100
CachyOS/CachyOS-PKGBUILDS#1917 ·
Maintainers usually reply within 1 day
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
bug needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day