# Juliaup install script verify checksum

**URL:** <https://discourse.julialang.org/t/juliaup-install-script-verify-checksum/110899>\
**Category:** New to Julia\
**Tags:** question, juliaup\
**Created:** [February 28, 2024, 1:41pm UTC](https://discourse.julialang.org/t/juliaup-install-script-verify-checksum/110899 "2024-02-28T13:41:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andy2K11](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/andy2k11/32/9967_2.png) [@Andy2K11](https://discourse.julialang.org/u/Andy2K11)\
**Post date:** [February 28, 2024, 1:41pm UTC](https://discourse.julialang.org/t/juliaup-install-script-verify-checksum/110899/1 "2024-02-28T13:41:47Z")

</div>

The installation instructions now recommend using:

```bash
curl -fsSL https://install.julialang.org | sh

```

There is a section in the [docs](https://julialang.org/downloads/#download_verification) that talks about download verifications which can be used like

```bash
curl https://julialang.org/assets/juliareleases.asc

gpg --import juliareleases.asc

curl https://julialang-s3.julialang.org/bin/linux/x64/1.10/julia-1.10.1-linux-x86_64.tar.gz

curl https://julialang-s3.julialang.org/bin/linux/x64/1.10/julia-1.10.1-linux-x86_64.tar.gz.asc

gpg --verify julia-1.10.1-linux-x86_64.tar.gz.asc julia-1.10.1-linux-x86_64.tar.gz
gpg: Signature made Wed 14 Feb 2024 18:54:40 GMT
gpg: using RSA key 3673DF529D9049477F76B37566E3C7DC03D6E495
gpg: Good signature from "Julia (Binary signing key) <buildbot@julialang.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3673 DF52 9D90 4947 7F76 B375 66E3 C7DC 03D6 E495

```

However, I’m not sure how to verify the `install.sh` script that does the installation of juliaup?

Should there be a `.asc` file that can be used to verify `https://install.julialang.org`?

It seems unsafe to download a script from the internet and run it immediately without checking it somehow.

I’m trying to automate the process, so for now, I have downloaded the install script and read through it before calculating its checksum `sha512sum`, which I can use later for my automation.

---

<div class="post-metadata">

**Author:** ![sijo](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@sijo](https://discourse.julialang.org/u/sijo)\
**Post date:** [February 28, 2024, 1:59pm UTC](https://discourse.julialang.org/t/juliaup-install-script-verify-checksum/110899/2 "2024-02-28T13:59:50Z")

</div>

I guess it would be nice to have a GPG signature for the shell script.

But is it any worse to trust the shell script downloaded over https, compared to trusting the GPG key downloaded in the same way? In both cases you can download it once in a trusted environment, then use it in different places. (I’m not sure how frequently the shell script gets updated… Maybe it’s a problem if you need to always have the latest version.)

---

<div class="post-metadata">

**Author:** ![Andy2K11](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/andy2k11/32/9967_2.png) [@Andy2K11](https://discourse.julialang.org/u/Andy2K11)\
**Post date:** [February 28, 2024, 2:22pm UTC](https://discourse.julialang.org/t/juliaup-install-script-verify-checksum/110899/3 "2024-02-28T14:22:56Z")

</div>

It is possible to get julialang’s public key from other sources e.g. a [keyserver](https://keyserver.ubuntu.com/pks/lookup?search=buildbot%40julialang.org&fingerprint=on&op=index)

I can then

```bash
gpg --show-keys armored-keys.asc 
pub rsa4096 2015-09-10 [SC]
      3673DF529D9049477F76B37566E3C7DC03D6E495
uid Julia (Binary signing key) <buildbot@julialang.org>
sub rsa4096 2015-09-10 [E]

```

Note that the fingerprints match. I believe in the good 'ole days people would have key-swap parties but I am usually happy if I can verify a key from a second source (not the same website, which may have been compromised).

The practical solution, that you’ve suggested, is to rely on the `install.sh` script infrequently changing and so not to download it anew each time I want to “up” a new system, or perhaps manually verify once and use a checksum so that the installation errors if the install script is updated and then I know something has changed.

I just thought I’d missed something because julialang seem to have been so careful providing gpg keys and checksums, and then suggest running a script with NO checks at all; something didn’t compute.

* * *

If it’s of interest, this is what I’m currently using

```yaml
---
- name: Check if .julia directory exists before installation
  ansible.builtin.stat:
    path: "{{ ansible_user_dir }}/.julia"
  register: julia_dir_before_installation
  changed_when: false

- name: Download juliaup installation script
  ansible.builtin.get_url:
    url: "{{ julia_up_url }}"
    dest: /tmp/juliaup.install.sh
    mode: "0755"
    checksum: sha512:fe174e112a8a7405802e2c6ad0bedaaf1576a3fe1863fc8e1d60acb36fc0020a6ea06abbe361c09958242afc866f929891520c5a6787fe97d9d15e84c656ea32
  when: not julia_dir_before_installation.stat.exists

- name: Run juliaup installation script
  ansible.builtin.command: /tmp/juliaup.install.sh -y
  register: result
  when: not julia_dir_before_installation.stat.exists
  changed_when: "'already installed' not in result.stdout"

```