Windows 10 PC w/ WSL + Ubuntu, docker already installed. Following the VPS directions for WSL, here's the initial output: [SparkBox] Running in VPS mode [SparkBox] Network profile: private (default-route source IP is private/CGNAT: 172.24.80.22) [SparkBox] Data directory (media/photos/books/manga): /opt/sparkbox/data [SparkBox] System clock is in sync (-1s off Cloudflare's reference) [SparkBox] Detected: Ubuntu 16.04.7 LTS [SparkBox] Installing system dependencies (detected: debian)... [SparkBox] System dependencies installed (debian). [SparkBox] Docker already installed: Docker version 29.4.1, build 055a478 [SparkBox] Docker Compose: 5.1.3 [SparkBox] Downloading SparkBox... [SparkBox] Verifying release integrity... [SparkBox] SHA256 digest verified [SparkBox] ed25519 signature verification FAILED. Release is not authentic. [SparkBox] Do NOT retry — this is a supply-chain tamper signal. curl: (23) Failed writing body (2899 != 4229) ...Bad timing on my part? Or symptom of something I missed? Can't provide any sparkbox doctor logs as it hasn't gotten that far, obviously. Thanks in advance!
6 replies
tomspark wrote:
Heads up — that's a false positive, not a real tamper. SHA256 verified means you got the right tarball; the ed25519 step failed because Ubuntu 16.04's OpenSSL 1.0.2g doesn't support ed25519 verification (the pkeyutl -rawin flag we use was added in OpenSSL 1.1.1, Sept 2018). Not a supply-chain attack — install.sh's wording is just too aggressive on EOL distros, our bug. Two paths: 1) Upgrade your WSL distro: Ubuntu 16.04 went EOL April 2021. From PowerShell: wsl --install -d Ubuntu-24.04, then run install.sh inside the new distro. Faster and you get current security patches. 2) Build OpenSSL 1.1.1+ from source on 16.04 — works but you're maintaining EOL Ubuntu indefinitely. Patching install.sh to detect old-openssl and give a clearer error than 'supply-chain tamper' so the next user doesn't get scared. Sorry for the wording.
fellini wrote:
Ah, thanks, thought I had already upgraded Ubuntu. I'll give that a whirl. Cheers!
tomspark wrote:
Cheers — ping back if it doesn't work after the distro upgrade. v1.6.72 also just shipped with a friendlier error message for that exact case, so future you (or anyone else hitting it) gets a clear 'upgrade your distro' instead of the supply-chain warning.
fellini wrote:
That did the trick, thanks. I've hit another glitch that I believe is due to my already having a pihole container running on Windows' Docker Desktop. But I'll sort that out tomorrow.
tomspark wrote:
Glad it worked. For the pihole conflict tomorrow — easiest fix is set PIHOLEDNSPORT=5353 in /opt/sparkbox/.env to skip the port-53 clash with your existing pihole, or just don't enable the SparkBox pihole module in the wizard. Ping back if it's something different.
tomspark wrote:
Followup — if the 'another glitch' you hit was install.sh exiting with bash: line 2382: local: can only be used in a function and showing exit code 1, that's fixed in v1.6.83 (just shipped). Stray local outside a function killed the end-of-install summary block — install was actually completing fine on disk, just looked like it failed. curl -fsSL https://get.tomsparkbox.com/install.sh | sudo bash again on a clean re-install will show the proper INSTALL COMPLETE summary now.