Aktualisiere Labeler-Konfiguration und verbessere Installationsskript für bessere Lesbarkeit und Sicherheit

Author: JosunLP

.github/labeler.yml

@@ -73,20 +73,20 @@
 
 'type:feature':
   - head-branch:
-  - '^(?:[Ff][Ee][Aa][Tt][Uu][Rr][Ee]|[Ff][Ee][Aa][Tt])[-/].+'
+      - '^(?:[Ff][Ee][Aa][Tt][Uu][Rr][Ee]|[Ff][Ee][Aa][Tt])[-/].+'
 
 'type:task':
   - head-branch:
       - '^(?:[Tt][Aa][Ss][Kk]|[Cc][Hh][Oo][Rr][Ee])[-/].+'
 
 'type:release':
   - head-branch:
-  - '^[Rr][Ee][Ll][Ee][Aa][Ss][Ee][-/].+'
+      - '^[Rr][Ee][Ll][Ee][Aa][Ss][Ee][-/].+'
 
 'type:bugfix':
   - head-branch:
-  - '^(?:[Bb][Uu][Gg][Ff][Ii][Xx]|[Ff][Ii][Xx])[-/].+'
+      - '^(?:[Bb][Uu][Gg][Ff][Ii][Xx]|[Ff][Ii][Xx])[-/].+'
 
 'type:hotfix':
   - head-branch:
-  - '^[Hh][Oo][Tt][Ff][Ii][Xx][-/].+'
+      - '^[Hh][Oo][Tt][Ff][Ii][Xx][-/].+'

.github/workflows/rust-build-and-release.yml

@@ -66,7 +66,7 @@ jobs:
           if [ "${{ runner.os }}" == "Windows" ]; then
             cp target/${{ matrix.target }}/release/${{ matrix.artifact_name }} dist/${{ matrix.asset_name }}
             cp install.sh dist/install.sh
-            chmod +x dist/install.sh || true
+            # Skipping chmod on Windows; not required
             cd dist
             7z a ../${{ matrix.asset_name }}.zip ${{ matrix.asset_name }} install.sh
           else

hypnoscript-cli/src/main.rs

@@ -320,14 +320,10 @@ fn build_agent() -> Agent {
         .build()
 }
 
-fn github_get(agent: &Agent, url: &str) -> Request {
+fn github_get(agent: &Agent, url: &str) -> ureq::Request {
     let mut request = agent
         .get(url)
-        .set("Accept", "application/vnd.github+json")
-        .set(
-            "User-Agent",
-            &format!("hypnoscript-cli/{}", env!("CARGO_PKG_VERSION")),
-        );
+        .set("Accept", "application/vnd.github+json");
 
     if let Ok(token) = env::var("GITHUB_TOKEN") {
         request = request

install.sh

@@ -1,5 +1,16 @@
 #!/usr/bin/env bash
 # HypnoScript runtime installer / updater
+#
+# SECURITY NOTICE:
+# This installer script may be executed via a command like:
+#   curl -fsSL <URL> | bash
+# Downloading and executing remote code via a pipe to bash can be dangerous.
+# You should always review the script before running it, and consider downloading
+# and inspecting it first:
+#   curl -fsSL <URL> -o install.sh
+#   less install.sh
+#   bash install.sh
+#
 
 set -euo pipefail
 
@@ -387,21 +398,21 @@ fi
 
 info "Installing to $DEST_DIR"
 if [[ ! -w "$DEST_DIR" ]]; then
-  $SUDO_PREFIX mkdir -p "$DEST_DIR"
+  ${SUDO_PREFIX}mkdir -p "$DEST_DIR"
 fi
-$SUDO_PREFIX install -m 0755 "$UNPACK_DIR/hypnoscript" "$DEST_DIR/hypnoscript"
+${SUDO_PREFIX}install -m 0755 "$UNPACK_DIR/hypnoscript" "$DEST_DIR/hypnoscript"
 
 META_DIR="$DEST_DIR/../share/hypnoscript"
-$SUDO_PREFIX mkdir -p "$META_DIR"
+${SUDO_PREFIX}mkdir -p "$META_DIR"
 
 if [[ -f "$UNPACK_DIR/VERSION.txt" ]]; then
-  $SUDO_PREFIX install -m 0644 "$UNPACK_DIR/VERSION.txt" "$META_DIR/VERSION.txt"
+  ${SUDO_PREFIX}install -m 0644 "$UNPACK_DIR/VERSION.txt" "$META_DIR/VERSION.txt"
 fi
 
 if [[ -f "$UNPACK_DIR/install.sh" ]]; then
-  $SUDO_PREFIX install -m 0755 "$UNPACK_DIR/install.sh" "$META_DIR/install.sh"
+  ${SUDO_PREFIX}install -m 0755 "$UNPACK_DIR/install.sh" "$META_DIR/install.sh"
 elif [[ -n "$SCRIPT_DIR" && -f "$SCRIPT_DIR/install.sh" ]]; then
-  $SUDO_PREFIX install -m 0755 "$SCRIPT_DIR/install.sh" "$META_DIR/install.sh"
+  ${SUDO_PREFIX}install -m 0755 "$SCRIPT_DIR/install.sh" "$META_DIR/install.sh"
 fi
 
 info_tmp=$(mktemp 2>/dev/null) || info_tmp="/tmp/hyp-install-info-$$"
@@ -415,7 +426,7 @@ cat >"$info_tmp" <<EOF
   "source": "installer"
 }
 EOF
-$SUDO_PREFIX install -m 0644 "$info_tmp" "$META_DIR/installation.json"
+${SUDO_PREFIX}install -m 0644 "$info_tmp" "$META_DIR/installation.json"
 rm -f "$info_tmp"
 
 trap - EXIT