openclaw - 💡(How to fix) Fix Harden Bun install: pin version + SHA256 checksum [1 comments, 1 participants]

TL;DR

Update the Dockerfile and Dockerfile.sandbox-common to download a specific version of Bun and verify its SHA256 checksum before installation.

Guidance

• Identify the specific version of Bun that is required and update the BUN_VERSION variable accordingly.
• Obtain the SHA256 checksum of the Bun binary from the official release notes and update the BUN_SHA256 variable.
• Replace the pipe-to-bash command with the suggested code snippet that downloads the binary, verifies the checksum, and unpacks it.
• Review the Dockerfile and Dockerfile.sandbox-common for any other instances of unverified downloads or installations.

Example

The provided code snippet in the issue body demonstrates how to download a specific version of Bun, verify its SHA256 checksum, and unpack it:

BUN_VERSION="1.2.5"
BUN_SHA256="<from official release>"
curl -fsSL "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_VERSION}/bun-linux-x64.zip" -o /tmp/bun.zip
echo "${BUN_SHA256}  /tmp/bun.zip" | sha256sum -c -
unzip /tmp/bun.zip -d /usr/local/bin

Replace <from official release> with the actual SHA256 checksum of the Bun binary.

Notes

This fix assumes that the official release notes provide the SHA256 checksum of the Bun binary. If the checksum is not available, an alternative verification method may be necessary.

Recommendation

Apply the workaround by updating the Dockerfile and Dockerfile.sandbox-common to use the suggested code snippet, as it provides a more secure way to download and install Bun by verifying the SHA256 checksum of the binary.