fix(security): 一键安装改走 HTTPS 并恢复证书校验 - #122
Open
sixiaopangai wants to merge 2 commits into
Open
Conversation
mirror.fishros.com 的证书此前已过期 324 天（2025-10-05 到期）， 这应是当初各处加上 --no-check-certificate 的原因。 该证书已于 2026-08-26 重新签发并部署（SAN 覆盖 fishros.com、 www.fishros.com、mirror.fishros.com，有效期至 2027-03-12）， HTTPS 已实测可正常访问，故可以恢复正常的证书校验。 改动内容： 1. FISHROS_URL 默认值由 http:// 改为 https:// - install:1 - install.py:5、install.py:163 2. 移除下载「会被执行的 Python 代码」时的 --no-check-certificate - install.py:166、171（下载 base.py / translator.py） - tools/base.py:1645、1657、1666（下载各 tool_*.py） - tools/translation/translator.py:43（下载语言包） - install.py:197（统计探测，fishros.org.cn 现已有有效证书） 仅传输加密而不校验证书，中间人仍可用自签证书替换脚本内容， 而这些脚本随后会以 sudo 权限执行，因此证书校验必须恢复。 保留未改动： - tools/translation/translator.py:85 访问第三方 ip.renfei.net， 仅取国家代码、非可执行内容，保守起见维持原样。
There was a problem hiding this comment.
🟡 Changes recommended
关键下载/执行链路在下载失败时缺少明确的失败处理与返回码校验，恢复证书校验后更容易触发失败并导致后续以不清晰的方式崩溃。
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
该 PR 针对一键安装链路的安全性做加固：将默认下载源切换为 HTTPS，并在关键下载点恢复证书校验，从而降低明文传输与“跳过证书校验”带来的中间人注入风险（尤其是下载后会被执行的 Python 代码）。
Changes:
- 默认
FISHROS_URL从http://切换为https://（入口脚本与install.py） - 移除多处
wget --no-check-certificate，恢复 TLS 证书校验（install.py/tools/base.py/translator.py） - 使用量统计探测下载同样恢复证书校验（
install.py）
File summaries
| File | Description |
|---|---|
install |
默认导出 FISHROS_URL=https://...，入口链路切换到 HTTPS |
install.py |
默认镜像 URL 切到 HTTPS，并移除下载 base.py / translator.py 与统计探测的 --no-check-certificate |
tools/base.py |
移除下载各 tool_*.py 时的 --no-check-certificate |
tools/translation/translator.py |
移除语言包下载的 --no-check-certificate |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
161
to
165
| def main(): | ||
| os.system("mkdir -p /tmp/fishinstall/tools/translation/assets") | ||
| url_prefix = os.environ.get("FISHROS_URL", "http://mirror.fishros.com/install/") | ||
| url_prefix = os.environ.get("FISHROS_URL", "https://mirror.fishros.com/install/") | ||
| if url_prefix: | ||
| os.system( |
Comment on lines
1643
to
1647
| def run_tool_url(url, url_prefix): | ||
| CmdTask( | ||
| "wget {} -O /tmp/fishinstall/tools/{} --no-check-certificate".format( | ||
| "wget {} -O /tmp/fishinstall/tools/{}".format( | ||
| url, url[url.rfind("/") + 1 :] | ||
| ) |
| temp_file = "/tmp/fishros_lang_{}.py".format(lang) | ||
| final_path = "/tmp/fishinstall/{}".format(lang_url.format(lang).replace(url_prefix, '')) | ||
| download_cmd = "wget {} -O {} --no-check-certificate".format(lang_url.format(lang), temp_file) | ||
| download_cmd = "wget {} -O {}".format(lang_url.format(lang), temp_file) |
README 里三处示例命令仍是 http://fishros.com/install。 脚本内部已经改成 HTTPS 并恢复证书校验，但用户是照着 README 复制这条命令去执行的，第一跳走明文的话，中间人可以在 301 跳转生效前把整个脚本换掉——脚本内部再怎么校验也没有意义。 改动只涉及协议头，命令行为不变。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
排查鱼香站点证书时发现，
mirror.fishros.com的 HTTPS 证书已过期 324 天（2025-10-05 到期）。这应该就是代码里各处加上--no-check-certificate的原因——不加就下载不动。该证书已于 2026-08-26 重新签发并部署完毕：
fishros.com、www.fishros.com、mirror.fishros.comhttps://mirror.fishros.com/install/install.py等路径可正常访问，内容与 HTTP 版 MD5 一致因此可以恢复正常的证书校验。
为什么这个改动重要
一键安装的执行流程是：
全程明文传输、且不校验证书，最终以 root 权限执行。 链路上任何一跳都可以替换脚本内容，直接拿到用户机器的 root 权限。
只把
http://改成https://是不够的——保留--no-check-certificate的话，中间人换一张自签证书照样能注入内容。两者必须一起改。改动内容
1.
FISHROS_URL默认值http://→https://installinstall.py2. 移除下载「会被执行的 Python 代码」时的
--no-check-certificateinstall.pybase.py/translator.pytools/base.pytool_*.pytools/translation/translator.pyinstall.pyfishros.org.cn现已有有效证书）保留未改动
tools/translation/translator.py:85访问第三方https://ip.renfei.net/，仅取国家代码、非可执行内容，且该域名不在鱼香控制范围内，保守起见维持原样。兼容性
Sectigo 这条链的根证书
USERTrust RSA Certification Authority自 2010 年起就包含在各主流发行版的 CA 库中，Ubuntu 16.04 及以上均可正常校验。验证
bash -n install通过.py文件ast.parse语法校验通过https://mirror.fishros.com/install/→ 下载install.py（11471B）/tools/base.py（56547B）/tools/tool_install_ros.py（30789B）全部成功相关
官网侧已同步配置
80 → 301 https跳转，因此文档中wget http://fishros.com/install的写法仍然可用（wget 默认跟随跳转）。若需要，可另行把docs/README.md里的示例也改为 https。