What ensures that this is a secure way to install php extensions?

[jameshulse]

I want to keep security in mind when developing our application docker images - what is the security story around trusting this specific script?

Imagine a maintainer decides to do something nefarious and we install the latest version from github. That script will run directly in our production image. Is this just a risk that we should accept for the convenience, or is there a policy / or some reassurance that we can lean back on?

I hope this doesn't come across the wrong way - the script is great and in my testing is much easier than doing manual installations myself. I'm just considering whether it is worth introducing that risk into our build process.

Thanks

[mlocati]

I think you have these options:

1. Trust me
2. Check the code at a specific version, and use it. Every now and then you can check the new versions and their changes, and upgrade the version you use. But even this approach is somehow risky: ince as a maintainer I can replace the script attached to any version, you should check the signature of the script (for example: you verify a version then you calculate its sha1, and when you use the script you check that the sha1 is ok).

is there a policy / or some reassurance that we can lean back on?

What so you mean? Would you like me to reassure you that I won't do anything harmful? Sure, I reassure you about that. But my reassurance doesn't change the fact that you still have to trust me.
So it doesn't change anything 😉

[jameshulse]

Thanks for the reply. Those are both good options.

I will do number 1, while also doing a version of number 2. I decided to just pull the script locally so it is always available.

What so you mean? Would you like me to reassure you that I won't do anything harmful? Sure, I reassure you about that. But my reassurance doesn't change the fact that you still have to trust me.

Totally. I guess I was wondering if there happened to be some kind indepedent evaluation performed. But I totally understand the limits of open source and I don't mean to put your credibility into question at all.

This is a fantastic project and has greatly simplified what I was working on. So you have my thanks!