Welcome to TrustLaunch, a project for generating one-liners that can safely boostrap most UNIX systems (macOS, Linux, etc.) through, wait for it, remote code exectution. Remote code execution is an inherrently unsafe operation, so a TrustLaunch project bounds the attack vectors available such that we do so responsibly in most contexts. The goal here is to provide a level of security high enough that this is a poor choice for a bad actor seeking to compromise you or your instituion. Mustering the resources it takes to compromise a TrustLaunch project need be out of the reach of individuals and most organizations, and simply not worth it for the largest instituions that can focus their attention on more effective strategies, like for instance, phishing. To learn more, check out the Security section.
We need a source of consistent and static human-readable text we know we can find on any bare-bones UNIX system. This is actually an almost intractible problem. The best options are wordlists, man pages, and license files. Unfortunately, wordlists are highly inconsistent across UNIX distros. License files are better, but the disincentives for updating a core UNIX command are even greater than a license. Larger bodies of unique text give us a better source of entropy for a checksum, so we favor the most fundamental and largest man pages we can find, and limit our search to only ones that haven't seen updates in decades. We then use the following tight one-linerto pull the unique words from our body of text to use as a source for a human-readable checksum.
man ls|grep -o '\b[a-z]\{3,\}\b'|sort -u
This TrustLaunch repository is a TrustLaunch project. You can create your own TrustLaunch project by cloning this down normally, or running this TrustLaunch one-liner.
Coming Soon
Just a note, caching layers between the user and the script repository will cause a delay between you updating the script and the new one-liner pulling it. This means after pulling a previous script, if you update it in your repository, and immediatly test the new one-liner, you will likely pull the previous script from the cache until it times out. I've seen this take as long as 30 seconds. In an automated deployment setting, or a tight test loop, or your own rapid-fire iteration with your aderol doped lightning fingers, you might run into this. So remember to account for it. If your consumers are humans, they are not likely running your repository script back-to-back repeatedly within the caching window, so it's unlikely to affect them. If your consumers are machines, the script will return a non-zero status code on failure, so you can sleep and retry if you like.
TrustLaunch verifies the boostrapping script's integrity before launching it. This means the contents of the launching script must match the hash supplied in the one-liner that the user is running. This guarentees a particular one-liner will result in the same code exectuing every time. However, TrustLaunch doesn't have an identity system to check authenticity. That is to say the script you've told it to run was indeed made by you, or some representative login credential or private key you have. This is great for common software paradigms such as distributing a tool or standing up a development environment. It is not appropriate for high-security environments or production environments. If an attacker can impersonate you and hand out new one-liners as though they are you, and the results of them doing that are bad, like all your data is now encyrpted and being ransomed for bitcoin, remote code exectution is not a good solution for you.