Adversarial Verifier Verdict — Installer Arc (Steal #5)

Date: 2026-07-10 Verifier: adversarial Opus (read-only on code; non-destructive probes only) Scope: 6 commits on feat/steal-5-installer over main b8c65c22 (94cc971e plan · 3715b349 Wave 1 · ce20af22 liveness fix · 364772ec Wave 2 CI+docs · 31295ad0 CI runner-context fix · 9606414d exec-bit restore). Contract: docs/plans/INSTALLER-ARC-2026-07-10.md (decisions D1-D10).

VERDICT: APPROVED (with residuals)

No CRITICAL or HIGH findings. The installer's security posture is genuinely strong on the dimensions that matter most for curl | bash software: no user-controlled value reaches any shell/eval sink, the whole script is wrapped in main() invoked on the last line (partial download cannot execute a destructive prefix), idempotency/marker timing is correct, and the CI smoke job is a real from-scratch Linux E2E that gates regressions (no always-green trap). Residuals below are 1 MEDIUM + 5 LOW, all non-blocking.

What I tried to break, and what held

1. Injection (hostile flag values / wizard answers) — HELD

Traced every user-controlled value (--dir --port --data-dir --branch --local-source + the five /dev/tty wizard answers) to every sink:

git clone --depth 1 --branch "$BRANCH" "$REPO_URL" "$INSTALL_DIR", mkdir -p "$INSTALL_DIR", cd "$INSTALL_DIR", the tar pipelines, bash …/waggle-server.sh start --port "$PORT" --data-dir "$DATA_DIR" — all pass values as quoted, already-expanded arguments. Bash does not re-parse variable contents for command substitution or word-into-command splitting, so --data-dir '$(rm -rf ~)' is stored and used as a literal directory name; the $( ) never executes.
The install marker (write_marker, install.sh:267-288) is the one place answers cross into a file, and it does so exactly per D6: PORT/DATA_DIR/BRANCH are passed as environment variables into node -e and emitted via JSON.stringify; the marker path is argv[1]. Zero shell interpolation. This is belt-and-suspenders — no other sink evals user input either.
verify_runtime runs a constant node script; there is no eval anywhere in either file. Result: D6 satisfied and exceeded. No injection path found.

2. `curl | bash` semantics — HELD (design strength)

Partial-download execution: all logic lives in functions; the only top-level statements before main are colour setup, the trap, arg-parsing (a no-op when $@ is empty, as under curl|bash), and OS detection — all harmless. main is literally the last line (install.sh:367). A truncated download therefore either syntax-errors before running anything, or defines functions and hits EOF before main — nothing destructive runs. Correct pattern.
/dev/tty absence (CI/docker): ask/ask_yesno/run_wizard all guard [ ! -e /dev/tty ] (and --yes) → silently take defaults. Verified.
Ctrl-C mid-install: trap on_interrupt INT restores tty (stty sane) and aborts; a partial dir without a marker is picked up by the resume branch next run.

3. Idempotency / resume — HELD

3-way branch (install.sh:324-340) is correct; the marker is written after build+verify and before start (install.sh:357), so its presence means "fully built." Failure between clone and marker → next run resumes (skips clone, re-runs npm install+build:packages). Re-run with marker → exit 0 with upgrade hint. write_marker timestamp-backs-up any existing marker.

4. `waggle-server.sh` process management — mostly HELD (see MEDIUM/LOW residuals)

Health-first liveness is the right call. stop refuses to signal when /health responds but no pidfile exists (won't kill an unidentified process on the port). read_pid sanitizes to digits. Stale pidfile (dead PID, free port) → start proceeds correctly. tasklist/taskkill fallbacks are correct for the msys/Git-Bash native-PID false-negative case.

5. Plan-vs-impl drift — D1-D10 all implemented as specified

Verified each decision against code. Only wording drift: D7 says "pure-bash timeout shim," but the health poll actually depends on curl/wget (the script comment even states "no pure-bash HTTP"). See MEDIUM-1.

6. CI gating — HELD

installer-smoke.yml triggers on push/PR touching install.sh, scripts/waggle-server.sh, or the workflow; runs shellcheck as a failing gate, then a real from-scratch install → boot → assert /health 200 → status → stop → assert port freed. No || true / continue-on-error on any assertion (the || true / || echo 000 occurrences are all in diagnostics/polling, not masking a gate). CI run 29096830297 = success, on HEAD commit 9606414d (verified via gh). shellcheck therefore passes on both scripts (proven by the green run).

7. CLAUDE.md §7 security — HELD

No hardcoded secrets in any scope file (grepped). No eval/dynamic-require. Vault untouched. .gitattributes addition (*.sh text eol=lf) is clean and does not disturb existing binary pins.

Residuals (non-blocking)

#	Sev	File:line	Issue	Break scenario / note
M-1	MEDIUM	`scripts/waggle-server.sh:82-91,141-149`	Health poll requires `curl` or `wget`; neither is checked by `install.sh` preflight. Contradicts D7's "pure-bash timeout shim."	On a minimal box with neither tool (e.g. some Alpine images), `start` spawns a healthy sidecar but `http_ok` returns 2, so `wait_for_health` times out at 60s and reports "did not become healthy" + exits 1 — a false failure. Non-security; clear error + log tail, no corruption. curl/wget is present on essentially every VPS/homelab image and is proven on the CI ubuntu runner, so real-world impact is low. Fix options: `/dev/tcp` fallback in `http_ok`, or add a curl/wget check to install.sh preflight.
L-1	LOW	`install.sh:246-252`	Predictable temp path `/tmp/waggle-verify.$$` for stderr capture (CWE-377).	On a shared multi-user box an attacker who wins a PID-guess race could pre-symlink the path and have the `2>` truncate a file the user can write. Single-user localhost typical; low probability. Fix: `mktemp`.
L-2	LOW	`scripts/waggle-server.sh:214-253`	PID-reuse in `stop`: if our server is down but the recorded integer PID was reused by an unrelated process not serving `/health` on our port, `signal_pid TERM/KILL` targets that process.	Standard pidfile-manager risk, single-user localhost; mitigated by the health-first early-return and the "refuse to signal unknown PID" guard. Matches industry norm.
L-3	LOW	`install.sh:78-79`; `waggle-server.sh:58-59`	`--port` is never validated as numeric.	`--port abc` yields a broken-but-safe install (health never comes up → clear timeout). No injection. CLAUDE.md coding-style asks for boundary validation — worth a `[[ "$PORT" =~ ^[0-9]+$ ]]` guard.
L-4	LOW	README.md:60 / getting-started.md:18	The documented one-liner points at `raw.githubusercontent.com/marolinik/waggle-os/main/install.sh`, but install.sh is not on `main` yet (only on `feat/steal-5-installer`).	The docs describe the post-merge reality. Slug `marolinik/waggle-os` is correct and the repo is PUBLIC. Sequencing dependency: the merge must land install.sh on `main` for the published one-liner to resolve; the README/getting-started edits should not be published ahead of that merge. Honest, not a lie — but flag the ordering.
L-5	LOW	`install.sh:88-90`	`--help` uses `sed -n '2,40p' "$0"`; under `curl \| bash`, `$0` is `bash`, so `--help` won't print the header.	Cosmetic; nobody pipes `--help`. Works when run as `./install.sh --help`.

Informational (out of scope / by design)

getting-started.md Options 2-3 reference github.com/marolinik/waggle (desktop releases + a git clone …/waggle.git) while origin is marolinik/waggle-os. These lines are pre-existing (not introduced by this arc) — noted for a future docs pass, not this verdict.
The resume branch (install.sh:330-337) runs npm install on pre-existing directory contents when a non-marked dir exists. This trusts the directory by design (it is the user's own machine); a pre-seeded malicious package.json postinstall would run, but that presupposes attacker write access to the user's home dir. Acceptable under the local trust model.

Bottom line: the security-critical properties (no injection, partial-download safety, correct idempotency, honest git-over-TLS acquisition, real gating CI) all hold. Ship it; address M-1 and L-1/L-3 as fast-follows, and ensure the merge lands install.sh on main before the README one-liner is relied upon (L-4).

8.6 KiB Raw Blame History