Challenge · Medium

Poisoned Mirror

The artifact fetcher grabs whatever the first mirror serves, and the first mirror has been poisoned. Teach the script to verify, fall back and fail closed.

shell scriptsha256sumsupply chainfail closed

Practises the module Software supply chain security.

The ticket

POSTMORTEM ACTION PM-42: verify every download

Last month a compromised mirror served a backdoored library and fetch-artifact installed it without a second look. The trusted checksums were in /etc/fetch/SHA256SUMS the whole time.

Start the challenge →