xinyin025/3x-ui
1
0
Fork 0
mirror of https://github.com/MHSanaei/3x-ui.git synced 2026-09-04 17:37:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(release): publish SHA-256 sums and verify them in install.sh/update.sh (#6393)

Browse Source 
* feat(release): publish SHA-256 sums and verify them in install.sh/update.sh

The installer and updater fetched the release archive and extracted it
after checking only that the file is not empty, and the release workflow
published no checksums. TLS protects the transport, not the bytes: a
truncated or swapped asset, a bad mirror or a TLS-terminating proxy was
installed as root. #5396 added this verification for the Xray archive;
the panel's own archive was the remaining unverified download.

Publish <asset>.sha256 next to every release archive (Linux and Windows)
and verify it before extracting. A mismatch aborts the install; a missing
sidecar, which every release before this change has, only warns, so
installing older tags keeps working.

Assisted-by: Claude Code:claude-fable-5-1

* fix(install): fail closed when the checksum sidecar cannot be fetched

Review follow-up. Any curl failure on the sidecar (5xx, reset, DNS) was
treated as "no checksum published", so whoever can swap the archive
could also drop the 90-byte sidecar request and skip the check. Only a
404, which every release before the sidecar existed returns, is still
tolerated with a warning; every other outcome aborts and removes the
downloaded archive.

Assisted-by: Claude Code:claude-fable-5-1

* fix(install): restore the closing brace lost in the main merge
This commit is contained in:
ilyusha
2026-09-03 21:44:00 +03:00
committed by GitHub
parent 4019f47de2
commit f294e1806d
3 changed files with 68 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
update.sh
+22
View File
@@ -1034,6 +1034,28 @@ update_x-ui() {
rm ${xui_folder}-linux-$(arch).tar.gz -f > /dev/null 2>&1
_fail "ERROR: Downloaded x-ui release archive is empty, please be sure that your server can access GitHub"
fi
# Releases publish <asset>.sha256 next to each archive. A mismatch or a
# failed sidecar download aborts the update; only a 404 (releases
# predating the sidecar) is tolerated with a warning.
archive="${xui_folder}-linux-$(arch).tar.gz"
rm -f "${archive}.sha256"
sidecar_code=$(${curl_bin} -sL --retry 3 --retry-delay 3 --connect-timeout 15 --max-time 60 -o "${archive}.sha256" -w '%{http_code}' "https://github.com/MHSanaei/3x-ui/releases/download/${tag_version}/x-ui-linux-$(arch).tar.gz.sha256" 2> /dev/null)
if [[ "${sidecar_code}" == "200" ]]; then
expected_sha256=$(awk 'NR == 1 {print $1}' "${archive}.sha256")
actual_sha256=$(sha256sum "${archive}" | awk '{print $1}')
rm -f "${archive}.sha256"
if [[ ! "${expected_sha256}" =~ ^[0-9a-f]{64}$ || "${expected_sha256}" != "${actual_sha256}" ]]; then
rm -f "${archive}"
_fail "ERROR: Checksum mismatch for $(basename "${archive}"): expected ${expected_sha256:-<none>}, got ${actual_sha256}"
fi
echo -e "${green}Checksum verified: ${actual_sha256}${plain}"
elif [[ "${sidecar_code}" == "404" ]]; then
rm -f "${archive}.sha256"
echo -e "${yellow}No checksum published for this release, skipping verification${plain}"
else
rm -f "${archive}.sha256" "${archive}"
_fail "ERROR: Failed to download the checksum for x-ui-linux-$(arch).tar.gz (HTTP ${sidecar_code})"
fi
if [[ -e ${xui_folder}/ ]]; then
echo -e "${green}Stopping x-ui...${plain}"