Protect upgrades from downgrade attacks
Open
Nobody has claimed this yet.
enhancement
security
- Dominant language
- Rust
- Stars
- 7k
- Forks
- 1.1k
- Avg merge
- 22h 40m
- Merged PRs (30d)
- 46
Description
Discussed briefly on the sandstorm blog post on curl | sh. The installer should refuse to upgrade to old revisions.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing rustup's installer upgrade path and how revisions are compared; read the linked curl | sh discussion for the threat context. Done means an attempted upgrade to an older revision is refused, with tests covering that behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100