Skip to content

Fix for cross-platform installation issues (macOS/Linux) #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
0x3xplt1 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix for cross-platform installation issues (macOS/Linux) #28

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
#!/bin/bash
sed "1s|.*|#!$(which python2)|" gopherus.py > tmp && mv tmp gopherus.py
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This shebang rewrite can silently produce an invalid #! line when python2 is not on PATH (common on macOS where it may be python2.7 or not installed). It also relies on which (not POSIX) and uses a fixed temporary filename (tmp) that can collide with an existing file or be clobbered on reruns. Consider: (1) resolve the interpreter with command -v and fail fast with a clear error if not found (before modifying gopherus.py), optionally trying common fallbacks like python2.7; (2) use mktemp (and a trap/cleanup) for the temporary file; and (3) quote paths/variables to handle spaces safely.

Copilot uses AI. Check for mistakes.
python2 -m pip install argparse
python2 -m pip install requests
Comment on lines 3 to 4
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The python2 -m pip install argparse and python2 -m pip install requests commands fetch and execute third-party packages from PyPI without pinning versions or verifying integrity, which creates a supply-chain risk: if those packages (or the index) are compromised, arbitrary code can run during installation with the install user's privileges. To mitigate this, pin dependencies to specific versions (e.g., via a requirements.txt) and, where possible, enable hash-based verification so the installer only accepts known-good artifacts.

Copilot uses AI. Check for mistakes.
chmod +x gopherus.py
Expand Down
Loading