diff --git a/SKILL.md b/SKILL.md index fa272905..ab645888 100644 --- a/SKILL.md +++ b/SKILL.md @@ -309,7 +309,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/benchmark/SKILL.md b/benchmark/SKILL.md index 51e39a10..7443911d 100644 --- a/benchmark/SKILL.md +++ b/benchmark/SKILL.md @@ -280,7 +280,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/browse/SKILL.md b/browse/SKILL.md index a9f95ec2..22aa6e40 100644 --- a/browse/SKILL.md +++ b/browse/SKILL.md @@ -285,7 +285,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/canary/SKILL.md b/canary/SKILL.md index ed814098..b94c9e8b 100644 --- a/canary/SKILL.md +++ b/canary/SKILL.md @@ -345,7 +345,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/connect-chrome/SKILL.md b/connect-chrome/SKILL.md index 57826bbd..f9cce4ec 100644 --- a/connect-chrome/SKILL.md +++ b/connect-chrome/SKILL.md @@ -366,7 +366,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/design-consultation/SKILL.md b/design-consultation/SKILL.md index 86971887..e581563f 100644 --- a/design-consultation/SKILL.md +++ b/design-consultation/SKILL.md @@ -410,7 +410,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/design-review/SKILL.md b/design-review/SKILL.md index fb082442..4bb079ae 100644 --- a/design-review/SKILL.md +++ b/design-review/SKILL.md @@ -417,7 +417,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/land-and-deploy/SKILL.md b/land-and-deploy/SKILL.md index e54bb159..e65b0c77 100644 --- a/land-and-deploy/SKILL.md +++ b/land-and-deploy/SKILL.md @@ -362,7 +362,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/office-hours/SKILL.md b/office-hours/SKILL.md index 34aa9070..c2f55cf2 100644 --- a/office-hours/SKILL.md +++ b/office-hours/SKILL.md @@ -370,7 +370,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/qa-only/SKILL.md b/qa-only/SKILL.md index 6161dc31..c2e9e4ee 100644 --- a/qa-only/SKILL.md +++ b/qa-only/SKILL.md @@ -383,7 +383,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/qa/SKILL.md b/qa/SKILL.md index bf532784..1125469b 100644 --- a/qa/SKILL.md +++ b/qa/SKILL.md @@ -458,7 +458,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/scripts/resolvers/browse.ts b/scripts/resolvers/browse.ts index 87537b8d..bd59bd8f 100644 --- a/scripts/resolvers/browse.ts +++ b/scripts/resolvers/browse.ts @@ -107,7 +107,19 @@ If \`NEEDS_SETUP\`: 3. If \`bun\` is not installed: \`\`\`bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi \`\`\``; } diff --git a/setup b/setup index e66a6df0..c44e8e54 100755 --- a/setup +++ b/setup @@ -4,7 +4,12 @@ set -e if ! command -v bun >/dev/null 2>&1; then echo "Error: bun is required but not installed." >&2 - echo "Install it: curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash" >&2 + echo "Install with checksum verification:" >&2 + echo ' BUN_VERSION="1.3.10"' >&2 + echo ' tmpfile=$(mktemp)' >&2 + echo ' curl -fsSL "https://bun.sh/install" -o "$tmpfile"' >&2 + echo ' echo "Verify checksum before running: shasum -a 256 $tmpfile"' >&2 + echo ' BUN_VERSION="$BUN_VERSION" bash "$tmpfile" && rm "$tmpfile"' >&2 exit 1 fi diff --git a/setup-browser-cookies/SKILL.md b/setup-browser-cookies/SKILL.md index 69617692..57ae0fbe 100644 --- a/setup-browser-cookies/SKILL.md +++ b/setup-browser-cookies/SKILL.md @@ -300,7 +300,19 @@ If `NEEDS_SETUP`: 3. If `bun` is not installed: ```bash if ! command -v bun >/dev/null 2>&1; then - curl -fsSL https://bun.sh/install | BUN_VERSION=1.3.10 bash + BUN_VERSION="1.3.10" + BUN_INSTALL_SHA="bab8acfb046aac8c72407bdcce903957665d655d7acaa3e11c7c4616beae68dd" + tmpfile=$(mktemp) + curl -fsSL "https://bun.sh/install" -o "$tmpfile" + actual_sha=$(shasum -a 256 "$tmpfile" | awk '{print $1}') + if [ "$actual_sha" != "$BUN_INSTALL_SHA" ]; then + echo "ERROR: bun install script checksum mismatch" >&2 + echo " expected: $BUN_INSTALL_SHA" >&2 + echo " got: $actual_sha" >&2 + rm "$tmpfile"; exit 1 + fi + BUN_VERSION="$BUN_VERSION" bash "$tmpfile" + rm "$tmpfile" fi ``` diff --git a/test/audit-compliance.test.ts b/test/audit-compliance.test.ts index 9a1980d0..e3b57e21 100644 --- a/test/audit-compliance.test.ts +++ b/test/audit-compliance.test.ts @@ -45,15 +45,17 @@ describe('Audit compliance', () => { expect(completionSection).toContain('_TEL" != "off"'); }); - // Fix 3: W012 — Bun install is version-pinned - test('bun install commands use version pinning', () => { + // Round 2 Fix 1: W012 — Bun install uses checksum verification + test('bun install uses checksum-verified method', () => { const browseResolver = readFileSync(join(ROOT, 'scripts/resolvers/browse.ts'), 'utf-8'); - expect(browseResolver).toContain('BUN_VERSION'); - // Should not have unpinned curl|bash (without BUN_VERSION on same line) - const lines = browseResolver.split('\n'); + expect(browseResolver).toContain('shasum -a 256'); + expect(browseResolver).toContain('BUN_INSTALL_SHA'); + const setup = readFileSync(join(ROOT, 'setup'), 'utf-8'); + // Setup error message should not have unverified curl|bash + const lines = setup.split('\n'); for (const line of lines) { - if (line.includes('bun.sh/install') && line.includes('bash') && !line.includes('BUN_VERSION') && !line.includes('command -v')) { - throw new Error(`Unpinned bun install found: ${line.trim()}`); + if (line.includes('bun.sh/install') && line.includes('| bash') && !line.includes('shasum')) { + throw new Error(`Unverified bun install found: ${line.trim()}`); } } });