Skip to content

AppImage publishing relies on script hosted on another web site #3179

@SteveL-MSFT

Description

@SteveL-MSFT

Merged #2082 prematurely. @lzybkr brought to my attention that his concern wasn't addressed.

https://github.com/PowerShell/PowerShell/blob/master/tools/appimage.sh#L41

Relies on

https://github.com/probonopd/AppImages/raw/e05cbebc62c86f8c602d74d9050bbfbf10df1c69/functions.sh 

which internally gets and executes other scripts.

If any of these scripts are compromised, we'll run arbitrary code as part of our publishing pipeline.
We need to resolve this vulnerability before we start publishing appimages.

CC @raghushantha @andschwa @probonopd

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions