Latest install curl lacks -f; HTTP error can install a broken hook #9

New issue

Closed

opened 2026-10-18 17:14:42 -07:00 by eric · 0 comments

eric commented

2026-10-18 17:14:42 -07:00

Owner

Severity: Low · Location: README line 170, script header line 98

The "Latest" install uses curl without -f. An HTTP 404 or 500 writes the error body into /usr/local/etc/rc.syshook.d/carp/10-wancarp. After chmod, that file is a broken hook and failover stops with no obvious sign.

The pinned-release path is safe, because a bad download fails sha256sum -c.

Suggested fix: use curl -fsSL ... -o ... in both places.

**Severity:** Low · **Location:** README line 170, script header line 98 The "Latest" install uses `curl` without `-f`. An HTTP 404 or 500 writes the error body into `/usr/local/etc/rc.syshook.d/carp/10-wancarp`. After `chmod`, that file is a broken hook and failover stops with no obvious sign. The pinned-release path is safe, because a bad download fails `sha256sum -c`. **Suggested fix:** use `curl -fsSL ... -o ...` in both places.

eric added the

bug

label

2026-10-18 17:14:42 -07:00

eric referenced this issue from a commit

2026-10-20 09:39:27 -07:00

fix: make install curl commands fail on HTTP errors

eric closed this issue

2026-10-20 09:39:27 -07:00