Harden InstallTarballPackage.sh with input & path validation, safer downloads, stricter error handling by emixor · Pull Request #27557 · PowerShell/PowerShell

…p cleanup, and quoting

### Motivation

- Improve robustness and safety of the tarball installation script by adding strict shell options and explicit input validation.
- Prevent unsafe filenames and malformed version strings from being used to construct download URLs or filesystem paths.
- Ensure temporary artifacts are cleaned up and downloads use secure, fail-fast curl options.

### Description

- Enabled strict error handling with `set -eu` and added parameter defaults using `${1:-}` and `${2:-}` for `POWERSHELL_VERSION` and `POWERSHELL_PACKAGE`.
- Added validation `case` checks to reject invalid `POWERSHELL_VERSION` and `POWERSHELL_PACKAGE` values and to enforce that the package ends with `.tar.gz`.
- Create a secure temporary directory via `mktemp -d`, register a `cleanup` function with `trap` to remove it, and download the package into the temp directory using `curl --fail --location --show-error --proto '=https' --tlsv1.2`.
- Use variables for `DOWNLOAD_URL`, `PACKAGE_PATH`, and `INSTALL_DIR`, update `tar` and `ln -s` invocations to use quoted variables, and ensure `/etc/shells` modifications are quoted and guarded with `grep`.

### Testing

- No automated tests were run on this change.

…p dir, and atomic symlink

### Motivation

- Make the PowerShell tarball install script more robust and secure by adding strict error handling and input validation.
- Avoid partial installs and leftover temporary files by using a temporary directory with cleanup on exit and making installations atomic.
- Improve download reliability and harden handling of filenames and paths to prevent injection or malformed input issues.

### Description

- Enable strict shell behavior with `set -eu` and validate `POWERSHELL_VERSION` and `POWERSHELL_PACKAGE` inputs with `case` patterns to reject unsafe values.
- Require the package to end with `.tar.gz` and construct `DOWNLOAD_URL`, `PACKAGE_PATH`, and `INSTALL_DIR` variables to centralize paths and filenames.
- Use `mktemp -d` to create a temporary directory and `trap` a `cleanup` function to remove it on `EXIT`, `HUP`, `INT`, and `TERM`.
- Download with `curl --fail --location --show-error --proto '=https' --tlsv1.2` to ensure secure and reliable transfers and extract the package using the variable paths.
- Create the symlink with `ln -sfn` for atomic updates and quote variables when writing or appending the path to `/etc/shells` while guarding duplicates with `grep -q`.

### Testing

- No automated tests were added or executed for this change.

…ion, and safer download/cleanup

### Motivation

- Improve security and robustness of the PowerShell tarball installer by validating inputs and verifying release checksums.
- Ensure downloaded artifacts are retrieved over a hardened TLS configuration and any temporary files are cleaned up.
- Make the script fail fast on unset variables and provide clearer error messages for invalid parameters.

### Description

- Turn on strict shell options with `set -eu` and validate positional parameters using `POWERSHELL_VERSION=${1:-}` and `POWERSHELL_PACKAGE=${2:-}`.
- Add input validation for `POWERSHELL_VERSION` and `POWERSHELL_PACKAGE`, including allowed character checks and enforcing a `.tar.gz` package extension.
- Download the package and `hashes.sha256` using secure `curl` options and verify the package SHA-256 against the release `hashes.sha256` file; introduce `get_file_sha256` helper to support `sha256sum` or `shasum`.
- Use a `mktemp` temporary directory with a `cleanup` trap for safe removal, use `INSTALL_DIR` and `PACKAGE_PATH` variables, and extract to the target directory; create an atomic symlink with `ln -sfn` and quote variables when writing to `/etc/shells`.

### Testing

- Ran `shellcheck` on the modified script and fixed issues flagged by the linter, which passed without errors.
- Executed an automated smoke test in a container that runs the script with a known release (example `7.6.2` / `powershell-7.6.2-linux-x64.tar.gz`), which completed with exit code `0` and created the expected install directory and `/usr/bin/pwsh` symlink.
- Verified checksum mismatch handling by an automated negative test that supplies a tampered package, which correctly failed checksum validation with a non-zero exit code.

Fixed 1 file(s) based on 2 unresolved review comments.

Co-authored-by: CodeRabbit <noreply@coderabbit.ai>

…xor/powershell

Harden InstallTarballPackage.sh: input validation, safe download, temp cleanup, and quoting