From ce31a5254ee676826bcbf375c121d4727116ab2c Mon Sep 17 00:00:00 2001
From: grabowski <berwn@buildfor.life>
Date: Wed, 22 Jul 2026 14:00:44 +0700
Subject: [PATCH] Harden install.sh per security review

- .env now chmod 0600 and APP_DIR chmod 0750 after chown, so the Matrix token
  and DB credentials are not world-readable.
- uv auto-install (curl | sh as root) is now opt-in via AUTO_INSTALL_UV=1 and
  pins a specific uv version; otherwise the script requires uv to be
  pre-installed and fails with instructions, avoiding unattended remote code
  execution as root.
---
 scripts/install.sh | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/scripts/install.sh b/scripts/install.sh
index e43109b..9a7bd71 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -55,9 +55,20 @@ else
 fi
 
 # 3. Build the uv-managed virtualenv ------------------------------------------
+# Prefer an already-installed uv. For stricter supply-chain control install uv
+# ahead of time via your distro / package manager; this script only fetches the
+# upstream installer (piped to a root shell) when AUTO_INSTALL_UV=1 is set, and
+# pins the version so the fetched script is reproducible.
+UV_VERSION="${UV_VERSION:-0.5.11}"
 if ! command -v uv >/dev/null 2>&1; then
-    log "Installing uv"
-    curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
+    if [ "${AUTO_INSTALL_UV:-0}" = "1" ]; then
+        warn "uv not found; installing pinned uv ${UV_VERSION} from astral.sh (runs as root)"
+        curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" \
+            | env UV_INSTALL_DIR=/usr/local/bin sh
+    else
+        die "uv not found. Install it (e.g. your package manager, or 'pipx install uv'),
+     or re-run with AUTO_INSTALL_UV=1 to fetch the pinned upstream installer."
+    fi
 fi
 UV="$(command -v uv)"
 
@@ -78,9 +89,16 @@ if [ ! -f "${APP_DIR}/.env" ]; then
     fi
 fi
 
-# 5. Ownership (service user needs write access for logs / stations.json) ------
+# 5. Ownership and permissions -------------------------------------------------
+# Service user needs write access for logs / stations.json.
 log "Setting ownership to ${SERVICE_USER}:${SERVICE_GROUP}"
 chown -R "${SERVICE_USER}:${SERVICE_GROUP}" "${APP_DIR}"
+# Restrict traversal to root + the service user, and lock down the secrets file
+# (contains the Matrix token and DB credentials).
+chmod 0750 "${APP_DIR}"
+if [ -f "${APP_DIR}/.env" ]; then
+    chmod 0600 "${APP_DIR}/.env"
+fi
 
 # 6. Install and enable the systemd unit --------------------------------------
 log "Installing systemd unit"