Guess how many people at Mozilla decide that a CA can become a root? 1
infosec.exchange8 pointsby kseifried8 comments
#!/bin/bash
SHA512="485fe3502978ad95e99f865756fd64c729820d15884fc735039b76de1b5459d32f8fadd050b66daf80d929d1082ad8729620925fb434bb09455304a639c9bc87"
# This line and everything later gets SHA512'ed and put in the above line.
# To generate the sha512 simply: tail -n +3 [SCRIPTNAME].sh | sha512sum
check_sha512() {
# Compute the SHA512 hash of the script excluding the first two lines
local current_sha=$(tail -n +3 "$0" | sha512sum | awk '{print $1}')
# Compare the computed SHA512 hash with the predefined one
if [[ "$current_sha" != "$SHA512" ]]; then
echo "Error: SHA512 hash does not match!"
exit 1
fi
}
# Call the function to perform the hash check
check_sha512
# Rest of your script starts here
echo "Script execution continues..."
The idea is simple: if the first line get's mangled (#!/bin/bash) the script probably won't execute at all.
If the second line gets mangled than obviously the SHA512 comparison won't work (variable name or value).