[security] Linux bootstrap executes unpinned installer scripts as root

[coygeek]

[security] Linux bootstrap executes unpinned installer scripts as root

Summary

Managed Linux leases that request Code or default-package Tailscale provisioning execute remote installer scripts as root during cloud-init without pinning the script, release artifact, signature, or checksum. This crosses the target policy's supply-chain integrity boundary for artifacts or images downloaded and installed as part of a documented workflow: a compromised installer endpoint, CDN path, or trusted network response can run arbitrary root commands inside a Crabbox-created lease before the lease is handed to the operator, including on Tailscale-enabled leases that immediately receive a one-off tailnet auth key.

Affected Components

• Checked commit: 5001cd1179a42c174da65c8e8a87bf16218aef95
• Component: worker bootstrap / managed Linux provisioning
• Affected files and lines:
  • worker/src/bootstrap.ts:1452-1455
  • worker/src/bootstrap.ts:1475-1495
  • worker/src/bootstrap.ts:1532-1544
  • worker/src/config.ts:267-273
  • worker/src/tailscale.ts:71-80
  • docs/features/tailscale.md:195-199
  • worker/test/bootstrap.test.ts:380-456

Attack Path

Attacker role:

provider response / upstream installer distribution compromise

Prerequisites:

• A Crabbox operator creates a managed Linux lease with --code, or creates a managed Linux lease with --tailscale while CRABBOX_TAILSCALE_INSTALL_MODE is unset or set to package.
• The attacker can influence the remote installer script response from https://code-server.dev/install.sh or https://tailscale.com/install.sh, for example through compromise of the upstream distribution path, CDN/account control, or a trusted network component.

Steps:

1. The operator requests a documented managed Linux workflow: Code provisioning with --code, or tailnet enrollment with --tailscale.
2. The Worker renders cloud-init that runs curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/usr/local for Code, or curl -fsSL https://tailscale.com/install.sh | sh for package-mode Tailscale.
3. The cloud-init script executes the fetched script as root before any local checksum, release version, signature, or pinned artifact validation occurs.
4. For Tailscale leases, the same bootstrap path then starts tailscaled and pipes the short-lived auth key into tailscale up, so compromised install-time code can run in the privileged provisioning context immediately before tailnet enrollment.

Expected result:

The attacker gains root code execution inside the managed lease during provisioning, before the operator's workload runs and before the lease is considered ready. On Tailscale-enabled leases, the compromised root context can also interfere with tailnet enrollment or access the ephemeral auth-key flow while the bootstrap is executing.

Control/dataflow:

remote installer endpoint response
  -> cloud-init generated by worker/src/bootstrap.ts
  -> root shell pipeline without pinned version/checksum/signature validation
  -> managed Linux lease provisioning
  -> root code execution and possible tailnet enrollment interference

Impact

This is a supply-chain integrity failure in Crabbox-managed bootstrap. A compromised installer response can modify the managed VM, persist in the operator's development environment, observe files synchronized into the lease, tamper with command results, and interfere with brokered Tailscale enrollment. The impact is confined to the newly provisioned lease rather than the Crabbox coordinator host, but it affects a documented default install path for --tailscale package mode and a documented Code provisioning path for managed Linux leases.

Severity Assessment

CVSS Assessment

Metric	v3.1	v4.0
Score	7.5 / 10.0	7.5 / 10.0
Severity	High	High
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Calculator	CVSS v3.1 Calculator	CVSS v4.0 Calculator

Recommended Remediation

• Do not pipe unauthenticated remote installer scripts directly into a root shell in generated cloud-init.
• Make the existing pinned Tailscale static archive mode the default for managed Linux leases, or require package installation through an explicitly pinned, signed package repository bootstrap whose signing key fingerprint and repository metadata are verified before installation.
• Replace Code provisioning with a pinned code-server release artifact or package repository flow that validates version and checksum/signature before installing into /usr/local.
• Fail lease creation when required pinned version/checksum metadata is unavailable, rather than silently falling back to install.sh pipelines.
• Add tests that assert generated cloud-init for --code and default --tailscale contains checksum/signature verification and does not contain curl ... | sh.

Validation

Validation method:

source review and existing unit-test inspection

Evidence and counterevidence:

• worker/src/bootstrap.ts:1452-1455 renders Code bootstrap as a root curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/usr/local pipeline when config.code is true.
• worker/src/bootstrap.ts:1475-1478 renders Tailscale bootstrap as a root curl -fsSL https://tailscale.com/install.sh | sh pipeline whenever config.tailscaleInstallMode !== "pinned".
• worker/src/bootstrap.ts:1479-1495 shows a safer pinned Tailscale path already exists: it downloads a versioned tarball, checks sha256sum -c -, and installs the extracted binaries.
• worker/src/config.ts:267-273 sets tailscaleInstallMode: "package" in normalized lease config.
• worker/src/tailscale.ts:71-80 maps missing CRABBOX_TAILSCALE_INSTALL_MODE to package and only selects pinned mode when the env var explicitly equals pinned.
• docs/features/tailscale.md:195-199 documents package install script mode as the default and pinned static archive mode as an opt-in alternative.
• worker/test/bootstrap.test.ts:380-456 asserts current generated bootstrap contains both unpinned installer-script URLs for the affected modes and asserts the pinned Tailscale mode does not contain https://tailscale.com/install.sh and does contain sha256sum -c -.
• Counterevidence considered: Code provisioning is only generated when --code is requested, and Tailscale package install is documented as the current default. The issue is therefore not an automatic compromise of every lease, but it remains in scope because the target policy includes integrity failures in downloaded artifacts/images installed as part of documented default workflows.
• Counterevidence considered: Tailscale supports a pinned mode, but it is opt-in and does not protect the documented default package mode or the Code installer path.
• Known-not-planned registry checked: no CBX-NP-* or CBX-DUP-* entry covers unpinned root-executed third-party installer scripts in managed Linux bootstrap.

Suggested regression coverage or verification:

• worker/test/bootstrap.test.ts: update Code and default Tailscale bootstrap tests to assert pinned release/checksum/signature verification and absence of curl -fsSL ... | sh pipelines.
• Add a focused test that default Tailscale config either renders pinned install mode or rejects missing checksum metadata before cloud-init generation.

npm test --prefix worker -- bootstrap.test.ts

Remaining uncertainty:

No live installer compromise or runtime MITM proof was attempted during discovery. The finding is based on source-confirmed root execution of unpinned remote installer scripts and the existing tests that lock in that behavior.

[coygeek]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

[clawsweeper]

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve. Reviewed July 1, 2026, 11:04 PM ET / 03:04 UTC.

Summary
Keep open: current main still emits the root curl-to-shell Code and default/package-mode Tailscale bootstrap paths, and the open closing candidate has not merged yet. The active path is to review and land or reject the linked fix PR rather than close this issue early.

Reproducibility: yes. for source-level reproduction: current main still emits the root Code and default Tailscale curl-to-shell installer paths, and tests assert those URLs. No live installer compromise was attempted.

Root-cause cluster
Relationship: canonical
Canonical: #715
Summary: This issue is the canonical open tracker for managed Linux Code and default/package-mode Tailscale installer integrity; the open PR is the candidate fix and related reports were consolidated here.

Members:

• fixed_by_candidate: Pin managed Linux bootstrap installers #742 - The PR body uses closing syntax for this issue and replaces the affected Code and Tailscale installer paths, but it remains open and unmerged.
• duplicate: [security] Linux bootstrap executes remote install scripts without pinning or digest verification #711 - A maintainer closed the broader report as a duplicate of this issue and named the same active fix PR.
• duplicate: [security] Unpinned code-server bootstrap executes upstream installer as root #723 - A maintainer closed the Code-only subset into this issue because the same fix PR covers both Code and Tailscale.
• superseded: [security] Pin and verify managed code-server bootstrap downloads #724 - The reporter closed this code-server-specific duplicate in favor of the report that was later consolidated into this canonical issue.
• adjacent_distinct: [security] Go CLI direct-provider browser bootstrap still trusts an unpinned Google APT key #760 - It reports a different managed Linux bootstrap trust problem in the Go direct-provider Google APT key path, not the Code/Tailscale installer-script root cause tracked here.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Next step
Do not queue a new repair lane while #742 is the open closing candidate and the remaining blockers are security review, live proof, and compatibility acceptance.

Security
Needs attention: The issue itself is security-sensitive, and source inspection confirms root-executed unverified third-party installer paths in managed bootstrap.

Review details

Best possible solution:

Keep this issue open until #742 or an equivalent fix lands with pinned verified installs, regression coverage, live canary proof, and an explicit compatibility decision.

Do we have a high-confidence way to reproduce the issue?

Yes for source-level reproduction: current main still emits the root Code and default Tailscale curl-to-shell installer paths, and tests assert those URLs. No live installer compromise was attempted.

Is this the best way to solve the issue?

Yes on the security direction: pinned, digest-verified artifacts match Crabbox's existing bootstrap integrity pattern. The exact landing path still needs maintainer approval because default/package-mode Tailscale behavior and fail-closed availability are upgrade-sensitive.

AGENTS.md: found and applied where relevant.

Remaining risk / open question:

• The active fix PR still needs maintainer acceptance of the CRABBOX_TAILSCALE_INSTALL_MODE=package compatibility change and live managed Linux Code plus Tailscale canary proof before merge.
• The reproduction is source-level; no live upstream compromise or network substitution proof was attempted.

Codex review notes: model internal, reasoning high; reviewed against 9c041ebb3eb5.

Label changes

Label changes:

• add P1: The issue describes root execution of unverified third-party installer bytes in documented managed lease bootstrap workflows with high impact if an upstream installer path is compromised.
• add impact:security: The affected behavior concerns supply-chain integrity, privileged bootstrap execution, and possible compromise of managed lease contents and Tailscale enrollment.
• add issue-rating: 🦞 diamond lobster: Current issue advisory state selects this label.
• add clawsweeper:source-repro: Current issue advisory state selects this label.
• add clawsweeper:linked-pr-open: Current issue advisory state selects this label.
• add clawsweeper:no-new-fix-pr: Current issue advisory state selects this label.
• add clawsweeper:needs-product-decision: Current issue advisory state selects this label.
• add clawsweeper:needs-security-review: Current issue advisory state selects this label.

Label justifications:

• P1: The issue describes root execution of unverified third-party installer bytes in documented managed lease bootstrap workflows with high impact if an upstream installer path is compromised.
• impact:security: The affected behavior concerns supply-chain integrity, privileged bootstrap execution, and possible compromise of managed lease contents and Tailscale enrollment.

Evidence reviewed

Security concerns:

• [high] Unverified code-server installer executes as root — worker/src/bootstrap.ts:1457
  Managed Linux Code bootstrap downloads the mutable code-server install script and pipes it to sh as root without a pinned version, digest, or signature check.
  Confidence: 0.95
• [high] Default Tailscale installer executes as root — worker/src/bootstrap.ts:1480
  Default/package-mode Tailscale bootstrap downloads the mutable Tailscale install script and pipes it to sh before tailnet enrollment, while the verified archive path is opt-in.
  Confidence: 0.93

What I checked:

• Repository policy read: AGENTS.md was read fully and its Crabbox structure, security/configuration, and validation guidance was applied as review context. (AGENTS.md:1, 9c041ebb3eb5)
• Current main still executes the Code installer script: The Worker bootstrap still runs code-server's remote install script through a root shell when Code is requested. (worker/src/bootstrap.ts:1457, 9c041ebb3eb5)
• Current main still executes the default Tailscale installer script: The Worker Tailscale install helper still returns the package-mode curl-to-shell installer whenever the mode is not pinned. (worker/src/bootstrap.ts:1480, 9c041ebb3eb5)
• Default Worker config selects package mode: Normalized Worker lease config defaults tailscaleInstallMode to package, and env parsing only selects pinned mode when explicitly requested. (worker/src/config.ts:271, 9c041ebb3eb5)
• Current tests lock in the vulnerable generated output: Worker bootstrap tests still assert the Code and Tailscale installer URLs in generated cloud-init, with checksum verification only for explicit pinned Tailscale mode. (worker/test/bootstrap.test.ts:402, 9c041ebb3eb5)
• Go bootstrap has the same root installer-script behavior: The direct Go bootstrap generator also emits the Code installer script and package-mode Tailscale installer script. (internal/cli/bootstrap.go:1364, 9c041ebb3eb5)

Likely related people:

• coygeek: Git blame ties the current Code and Tailscale installer-script stanzas and default install-mode config to commit 4b97692. (role: introduced behavior in available history; confidence: high; commits: 4b97692bae03; files: worker/src/bootstrap.ts, internal/cli/bootstrap.go, worker/src/config.ts)
• vincentkoc: GitHub commit metadata lists vincentkoc as committer for the blamed commit containing the current installer-script behavior. (role: committer signal; confidence: medium; commits: 4b97692bae03; files: worker/src/bootstrap.ts, internal/cli/bootstrap.go, worker/src/tailscale.ts)
• steipete: Recent main commits changed adjacent bootstrap hardening and managed Linux provisioning code, including the Google signing-key hardening and desktop provisioning paths. (role: recent adjacent contributor; confidence: medium; commits: 9c041ebb3eb5, 399c94a8f7dc, 184979d683b7; files: worker/src/bootstrap.ts, internal/cli/bootstrap.go, worker/test/bootstrap.test.ts)
• TurboTheTurtle: The open closing PR for this issue is authored by TurboTheTurtle and changes the affected bootstrap, config, docs, and tests surfaces. (role: active candidate fix contributor; confidence: medium; commits: 7d3028c4166a, c4b49d97bdef; files: worker/src/bootstrap.ts, internal/cli/bootstrap.go, worker/src/tailscale.ts)

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[coygeek]

@clawsweeper re-review

[coygeek]

@clawsweeper re-review