Software auto-install defaults on without pinning or signing upstream

Summary

Software update checks and auto-install both default to on:

enabled = values.get("enabled", True)
auto_install = values.get("auto_install", True)

Every 10 minutes the watcher fetches @{upstream} and, if the checkout is a clean fast-forward of main, runs scripts/install (or install-linux). There is no origin allowlist and no tag/commit signature check. Origin is whatever the managed checkout tracks.

The Windows README bootstrap has the same class of problem: Invoke-WebRequest of raw.githubusercontent.com/splunk/token-meter/main/scripts/bootstrap-windows.ps1 with no hash pin.

Impact

Compromise of GitHub main, a force-push, or a user who cloned a fork and then turned this on becomes arbitrary code execution as that user, including rewrite of the systemd/LaunchAgent units.

Fast-forward-only + “must be on main” is a useful guard against local dirty/diverged state. It is not an authenticity check.

Suggested fix

• Default auto_install to off (keep periodic checks if you want).
• Before fetch/install, require origin to be https://github.com/splunk/token-meter.git (and the ssh equivalent).
• Prefer signed tags.
• Pin the Windows bootstrap script by hash, or stop fetching it from raw.githubusercontent.com as the documented install path.

Start by locating the watcher’s update configuration and fetch/install path, then inspect scripts/install, install-linux, and the Windows README bootstrap command. Verify how origin and branch state are obtained before implementing the proposed trust checks; done means auto-install is off by default, upstream authenticity is enforced, and the Windows bootstrap is pinned or no longer fetched remotely.