Skip to content

installer: gate cosign-absent warning behind PEV_VERBOSE #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
samcofer wants to merge 1 commit into
base: main
Choose a base branch
from
Open

installer: gate cosign-absent warning behind PEV_VERBOSE #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions scripts/install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,16 +14,18 @@
# PEV_VERSION — release tag to pin (default: latest, e.g. v0.0.2)
# PEV_INSTALL_DIR — destination directory (default: ~/.local/bin for non-root,
# /usr/local/bin for root)
# PEV_VERBOSE — set to 1 to surface the SHA-256-only fallback warning
# printed when cosign is not on PATH (default: quiet)
#
# Behavior:
# - Detects Linux amd64 / arm64; refuses other platforms.
# - Downloads the matching pev_linux_<arch> binary and the published
# pev_<version>_checksums.txt; verifies SHA-256 before install.
# - When `cosign` is on PATH, also verifies the keyless signature on the
# checksums file before trusting any SHA-256. Without cosign the
# installer prints a warning and proceeds with SHA-256-only — set
# PEV_REQUIRE_COSIGN=1 to make the missing-cosign case a hard error
# for regulated installs.
# installer proceeds with SHA-256-only (set PEV_VERBOSE=1 to see the
# downgrade warning) — set PEV_REQUIRE_COSIGN=1 to make the
# missing-cosign case a hard error for regulated installs.
# - Always overwrites: re-running upgrades in place.
#
# Verifying this script before running it is recommended for regulated
Expand All @@ -37,6 +39,10 @@ RELEASES_DOWNLOAD="https://github.com/${REPO}/releases/download"

err() { printf 'pev-install: %s\n' "$*" >&2; exit 1; }
log() { printf 'pev-install: %s\n' "$*"; }
# vlog prints only when PEV_VERBOSE=1; used for advisory notices (e.g. the
# cosign-absent SHA-256-only fallback) that are noise on the happy path but
# matter to operators auditing supply-chain verification.
vlog() { [ "${PEV_VERBOSE:-0}" = "1" ] && printf 'pev-install: %s\n' "$*"; return 0; }

need() { command -v "$1" >/dev/null 2>&1 || err "missing required tool: $1"; }
need curl
Expand Down Expand Up @@ -114,7 +120,7 @@ if command -v cosign >/dev/null 2>&1; then
elif [ "${PEV_REQUIRE_COSIGN:-0}" = "1" ]; then
err "cosign not on PATH and PEV_REQUIRE_COSIGN=1 — install cosign or unset the variable"
else
log "warning: cosign not on PATH; falling back to SHA-256 only (set PEV_REQUIRE_COSIGN=1 to hard-fail)"
vlog "warning: cosign not on PATH; falling back to SHA-256 only (set PEV_REQUIRE_COSIGN=1 to hard-fail)"
fi

# sha256sum -c needs the checksum line in its CWD-relative form. We grep the
Expand Down
Loading