On piping Curl to apt-key

I hate this practice, no idea how it became commonplace. Of course lots of times, installation procedures can be long and tedious, but it takes one popular project&#x27;s script server to be compromised, and tons of people are suddenly running malicious commands.<p>I would go through manually installing dependencies and setting up my system, adding repos, etc. over running some script any day. But then again some projects wouldn&#x27;t be that popular if they were hard to install.<p>Some of npm&#x27;s installation instructions ask you to pipe curl into bash, to run a lovely script [0] which makes things easier for you, but not by much. Is it really necessary? Would developers give up trying to get npm and node just because installing not as easy as &quot;curl <a href="https:&#x2F;&#x2F;some.script.com&#x2F;that-script.sh" rel="nofollow">https:&#x2F;&#x2F;some.script.com&#x2F;that-script.sh</a> | sudo -E bash -; sudo apt-get install npm&quot;?<p>Other than building&#x2F;installing programs, adding GPG&#x2F;SSH keys like in the blog post can be as dangerous, and while not simple, there could be some method built to make things easier without having to run commands you don&#x27;t even check.<p>Anyways, hope projects grow out of this habit.<p>[0] <a href="https:&#x2F;&#x2F;deb.nodesource.com&#x2F;setup_6.x" rel="nofollow">https:&#x2F;&#x2F;deb.nodesource.com&#x2F;setup_6.x</a>

Isn&#x27;t the solution to publish the key on a keyserver and fetch it with apt-key? Something like<p><pre><code> apt-key adv --keyserver hkp:&#x2F;&#x2F;keyserver.ubuntu.com:80 --recv-keys &lt;fingerprint&gt;</code></pre>

&gt; Consider the case where download.docker.com starts serving an evil key file<p>At that point I can&#x27;t trust the key ID in the docker documentation either. Since Docker doesn&#x27;t use web of trust (who does honestly?) there is no way that I can verify the key ID in any way in the provided key file. So I don&#x27;t know how it does any good inspecting the key file before adding it to the apt keyring.

On a related note, don&#x27;t copy commands from web and paste it to your shell (or any terminal program):<p><a href="http:&#x2F;&#x2F;thejh.net&#x2F;misc&#x2F;website-terminal-copy-paste" rel="nofollow">http:&#x2F;&#x2F;thejh.net&#x2F;misc&#x2F;website-terminal-copy-paste</a>

On piping anything from the Internet directly to your system for execution: Don&#x27;t be lazy. Don&#x27;t be an ass.<p>When I am working in a persona that responsible for managing a server or a service, I insist on knowing everything I need to know about how to keep that service and the environment in which it operates safe, alive, and providing usable performance.<p>I require good, clean and coherent instructions for deploying something at production level, where all required components and their preferred method of interaction are clearly explained and documented by the developer, and can be repeated in a predictable manner by me.<p>If all I have to work with is &quot;pipe this to the shell, alternatively read the code&quot; I&#x27;m going to go with &quot;nah, I&#x27;ll find something professional&quot;.<p>Time spent installing a system should be only a minuscule fraction of time spent actually operating the system. Spending a few extra hours doing it right shouldn&#x27;t make a difference.<p><i>[edit: added &quot;...and another thing&quot; argument]</i>

Wouldn&#x27;t it already help if apt-key printed the list of keys it imported instead of the absolutely superfluous &quot;OK&quot;?

Apt-key should just have a built-in way of importing keys from HTTP(s) URLs, preferably in interactive mode so you can confirm the keys are legitimate before adding them.

Would it be possible to write a &quot;confirm&quot; tool that writes stdin to stderr then waits for the user to press enter before writing to stdout?<p><pre><code> curl ... | confirm | apt-key ... </code></pre> Of course there&#x27;s no such thing as a stderr input stream, so I&#x27;m not sure this would even be possible.

Of my first steps into the world of Linux this year, this sort of procedure has been one of the most glaringly disturbing. Another similar was packages being downloaded over HTTP.