Is there a way to see what the install script will do before it does it?

Asked 14 Nov 202015,230 views2 answers

41votes

Our security team will not let anyone pipe a URL into a shell on a company laptop, and honestly I agree with them. I want to install SDODS but I need to be able to show someone what the script touches before I run it.

Is reading the script the only option, or does it have something better?

install cli

asked by Dinuka Perera412 · 14 Nov 2020

2 answers

36votes✓
Accepted answer
It has --dry-run, which prints every step and writes nothing. Download it, check the checksum, read it, then run it in dry-run mode:
bash
```
curl -fsSLO https://sdods.com/install.sh
curl -fsSLO https://sdods.com/install.sh.sha256
sha256sum -c install.sh.sha256
less install.sh
sh install.sh --dry-run
```
On macOS the checksum line is shasum -a 256 -c install.sh.sha256.
Every line of dry-run output that begins with "would" is a step that has not happened. Nothing is written, no shell profile is touched, no browser is downloaded.
Your shell profile is only ever edited when you pass --modify-path. Without it the installer prints the PATH line and leaves the editing to you, which is usually what a security review wants to hear.
The full contract is at Reference → Installer — options, what it writes, and what it refuses to do.
answered by Reeta Nandalmaintainer41,280 · 14 Nov 2020
12votes
Adding to that: --version-check is the other half. It detects what is on the machine and prints the paths it resolved, then exits without installing anything.
bash
```
sh install.sh --version-check
```
I paste that output into the change ticket. It answers "what will this touch" in one block, which is the question the reviewer actually has.
answered by Marijn Kuiper18,840 · 17 Nov 2020

Have a different question? Ask it.

Is there a way to see what the install script will do before it does it?

2 answers

Know the answer?

Related