hardening: hash-pin Oracle JDK 21 / JRE 8 downloads on Windows - #140
Open
brainbloodbarrier wants to merge 12 commits into
Open
hardening: hash-pin Oracle JDK 21 / JRE 8 downloads on Windows#140brainbloodbarrier wants to merge 12 commits into
brainbloodbarrier wants to merge 12 commits into
Conversation
Includes baseline architecture, 6-group review plan, prioritized findings, and arm64 macOS deployment requirements. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
…x flake for hash source; workflow reads hashes from files
…ncher, atomic update, and hash verification
… launcher, jpackage fixes, and hash verification
…acing, and add hash verification
…es and hash verification notes
The previous update.sh inherited install.sh verbatim, including sudo apt update && sudo apt install git wget openjdk-21-jre -y. Every update re-ran apt with sudo on already-provisioned machines. This rewrite keeps update.sh narrow: * require an existing git checkout in $HOME/Burpsuite-Professional * git pull --ff-only * revalidate VERSION/BURP_SHA256/LOADER_SHA256 * redownload and rehash the Burp JAR * rehash the bundled loader.jar * atomically replace /bin/burpsuitepro No package installs, no loader download, no Burp launch.
Launcher.jpg (capital L) and launcher.jpg (lowercase) tracked the same image. core.ignorecase=true on macOS hid the duplicate locally, but the repo on Linux/Nix shows both. The lowercase launcher.jpg is the one referenced by install_macos.sh and README.md; the capital-L variant is dead weight.
Adds JDK21_SHA256 and JRE8_SHA256 with the SHA-256 values captured from the current Oracle download URLs: - jdk-21_windows-x64_bin.exe - AutoDL BundleId 247947_... install.ps1 now calls Confirm-FileHash after downloading each installer and before executing it, failing closed on mismatch.
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
This PR modernizes the installers/packaging by centralizing the Burp version + hashes in repo files and enforcing SHA-256 verification across Linux/macOS/Windows, Nix, and CI.
Changes:
- Add strict bash execution (
set -euo pipefail) and rewrite Linux/macOS scripts to readVERSIONand verifyBURP_SHA256/LOADER_SHA256. - Improve Windows installer to verify Oracle JDK/JRE installers and the Burp/loader binaries via SHA-256.
- Update Nix flake/derivation and GitHub Actions workflow to consume
VERSION/BURP_SHA256, plus refresh README/agent guidelines.
Reviewed changes
Copilot reviewed 15 out of 16 changed files in this pull request and generated 14 comments.
Show a summary per file
| File | Description |
|---|---|
| update.sh | Reworked Linux updater to pull in-place, download pinned JAR, verify hashes, and atomically update /bin/burpsuitepro. |
| install.sh | Linux install now clones/updates into a fixed install dir and verifies JAR/loader hashes before launch. |
| install_macos.sh | macOS install now ensures prerequisites, verifies hashes, creates CLI launcher and app bundle. |
| install.ps1 | Windows install now avoids Win32_Product, adds hash helpers, and verifies downloaded installers/JAR/loader. |
| help.sh | Enables strict bash mode and makes argument handling safe with ${1:-}. |
| flake.nix | Refactors flake outputs to genAttrs and defines packages per system. |
| default.nix | Reads version/hash from repo files and updates fetch/runScript/meta fields. |
| .github/workflows/burp-pro.yml | CI now reads version/hash files, downloads from GitHub release mirror, and verifies SHA-256. |
| README.md | Rewritten documentation to reflect new versioning + verification behavior and per-platform steps. |
| VERSION / BURP_SHA256 / LOADER_SHA256 / JDK21_SHA256 / JRE8_SHA256 | Adds pinned version and expected hashes as single-source-of-truth inputs. |
| AGENTS.md | Adds repo guidelines, manual validation steps, and security notes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| productName = "pro"; | ||
| productDesktop = "BurpSuite Professional"; | ||
| burpHash = "sha256-17COQ9deYkzmaXBbg1arD3BQY7l3WZ9FakLXzTxgmr8="; | ||
| burpHash = lib.removeSuffix "\n" (lib.fileContents ./BURP_SHA256); |
| "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v${version}.jar" | ||
| ]; | ||
| hash = burpHash; | ||
| sha256 = burpHash; |
Comment on lines
+59
to
+60
| EXPECTED_SHA256=$(<BURP_SHA256) | ||
| EXPECTED_SHA256=$(printf '%s' "$EXPECTED_SHA256" | tr -d '[:space:]') |
Comment on lines
+65
to
+66
| ACTUAL_SHA256=$(shasum -a 256 "burpsuite_pro_v${version}.jar" | awk '{print $1}') | ||
| if [[ "$ACTUAL_SHA256" != "$EXPECTED_SHA256" ]]; then |
| --java-options "--add-opens=java.base/jdk.internal.org.objectweb.asm.Opcodes=ALL-UNNAMED" \ | ||
| --java-options "-javaagent:$(pwd)/loader.jar" \ | ||
| --java-options "-noverify" No newline at end of file | ||
| --java-options "-javaagent:\"${INSTALL_DIR}/loader.jar\"" \ |
| echo "`t`tDownloading Java JDK-21 ...." | ||
| wget "https://download.oracle.com/java/21/archive/jdk-21_windows-x64_bin.exe" -O jdk-21.exe | ||
| wget "https://download.oracle.com/java/21/archive/jdk-21_windows-x64_bin.exe" -O jdk-21.exe | ||
| Confirm-FileHash -Path 'jdk-21.exe' -ExpectedSha256 (Read-NormalizedHash -Path 'JDK21_SHA256') |
| if (!($Jre8)) { | ||
| echo "`n`t`tDownloading Java JRE ...." | ||
| wget "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=247947_0ae14417abb444ebb02b9815e2103550" -O jre-8.exe | ||
| Confirm-FileHash -Path 'jre-8.exe' -ExpectedSha256 (Read-NormalizedHash -Path 'JRE8_SHA256') |
Comment on lines
+84
to
+85
| Invoke-WebRequest -Uri "https://github.com/xiv3r/Burpsuite-Professional/releases/download/burpsuite-pro/burpsuite_pro_v$Version.jar" ` | ||
| -OutFile $JarFile -UseBasicParsing -ErrorAction Stop |
| # Download loader if it not exists | ||
| if (!(Test-Path loader.jar)){ | ||
| echo "`nDownloading Loader ...." | ||
| Invoke-WebRequest -Uri "https://github.com/xiv3r/Burpsuite-Professional/raw/refs/heads/main/loader.jar" -OutFile loader.jar -UseBasicParsing -ErrorAction Stop |
| echo "Installing Dependencies..." | ||
| sudo apt update | ||
| sudo apt install git wget openjdk-21-jre -y | ||
| INSTALL_DIR="$HOME/Burpsuite-Professional" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.