fhemberger

Node.js: Create checksums for npm's 'postinstall' actions

After watching Patrick Debois' talk from DeliveryConf »How Secure Is Your Build / Server?«, I tried to get at least a rough idea if postinstall steps where running at all and if they do the same things after a package update.

So I wrote a little proof of concept that will:

• Create a Dockerfile, using package.json and package-lock.json from a Node.js project in the current directory
• Install all its dependencies inside the Docker container first, without running any postinstall steps, then do the same with running the scripts.
• Reading the diff of those steps using Docker's image layers
• And calculate a checksum of those changes.

fhemberger

local usbLogger = hs.logger.new('usb', 'debug')

function configureKeyboard(data)
  -- Uncomment the "usbLogger" line below, plug in the USB keyboard and update the USB vendor and product ID
  local isKeyboardAffected = data.vendorID == 9610 and data.productID == 89
  -- usbLogger.df("eventType %s, pname %s, vname %s, vId %s, pId %s, keyboardAffected %s", data.eventType, data.productName, data.vendorName, data.vendorID, data.productID, isKeyboardAffected)
  if isKeyboardAffected and data.eventType == "added" then
    hs.keycodes.setLayout("U.S.")
  end
  if isKeyboardAffected and data.eventType == "removed" then

fhemberger

+ cat /lib/dracut/dracut-053
dracut-053
+ cat /proc/cmdline
+ sed -e 's/\(ftp:\/\/.*\):.*@/\1:*******@/g;s/\(cifs:\/\/.*\):.*@/\1:*******@/g;s/cifspass=[^ ]*/cifspass=*******/g;s/iscsi:.*@/iscsi:******@/g;s/rd.iscsi.password=[^ ]*/rd.iscsi.password=******/g;s/rd.iscsi.in.password=[^ ]*/rd.iscsi.in.password=******/g'
rootflags=rw mount.usrflags=ro BOOT_IMAGE=/flatcar/vmlinuz-a mount.usr=/dev/mapper/usr verity.usr=PARTUUID=7130c94a-213a-4e5a-8e26-6cce9662f132 rootflags=rw mount.usrflags=ro consoleblank=0 root=LABEL=ROOT console=ttyS0,115200n8 console=tty0 flatcar.first_boot=detected flatcar.oem.id=proxmoxve verity.usrhash=16261ecd72c9d30b45c8e9d1e52f6657408bc6ca8b70716dbfd030ea52f39326
+ '[' -f /etc/cmdline ']'
+ for _i in /etc/cmdline.d/*.conf
+ '[' -f /etc/cmdline.d/00-btrfs.conf ']'
+ echo /etc/cmdline.d/00-btrfs.conf
/etc/cmdline.d/00-btrfs.conf