scripts: switch verify-install.sh from curl to wget
What the developer wrote
Authored by ziggie
scripts: switch verify-install.sh from curl to wget
Replace curl with wget for downloading release manifests and
signatures in verify-install.sh. wget handles redirects, retries, and
error reporting more robustly by default, which avoids silent download
failures that caused misleading "Invalid signature!" errors.
Also add error checking to all download calls so failures are reported
immediately with the URL that failed, and log which signature file and
user failed gpg verification.
What changed, and why it matters
This commit changes the LND release verification helper script from using curl to using wget, and adds clearer error messages when downloads fail. The practical security issue being fixed is that curl could silently fail to download release signatures, which then made the script wrongly report 'Invalid signature!' instead of admitting the file simply didn't download. That misleading error could confuse users or hide network/download problems during install verification. It is a hardening/usability fix in a verification helper, not a fix for a vulnerability in the Lightning node itself.
Users who build from the Dockerfile or run verify-install.sh should pull this commit to benefit from clearer failure reporting and more reliable downloads. Operators relying on the script for supply-chain verification should re-run it after updating. No immediate runtime mitigation is required because the node binaries are unaffected.
Security signals we found
Tooling change from curl to wget for release artifact downloads
Addition of explicit error handling on all download calls
Fixes misleading 'Invalid signature!' error caused by silent download failures
Verification helper script only; no change to lnd/lncli runtime code
No vendor security advisory or CVE referenced in commit
Evidence from the diff
The patch modifies scripts/verify-install.sh and the Dockerfile to replace curl with wget for fetching GitHub release metadata, asset lists, the manifest, and detached signatures. wget was chosen because it handles HTTP redirects, retries, and non-success exit codes more robustly by default. The script now wraps each download in an || { echo …; exit 1; } block so failures stop immediately with the failing URL, rather than continuing with empty/missing files and producing a misleading GPG signature error. The Dockerfile dependency is updated accordingly. No cryptographic logic is changed.
Changed components
scripts/verify-install.shDockerfileInspect captured patch +19 / −7
diff --git a/Dockerfile b/Dockerfile
index a152d91..9cbe354 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,13 +29,13 @@ FROM alpine as final
VOLUME /root/.lnd
# Add utilities for quality of life and SSL-related reasons. We also require
-# curl and gpg for the signature verification script.
+# wget and gpg for the signature verification script.
RUN apk --no-cache add \
bash \
jq \
ca-certificates \
gnupg \
- curl
+ wget
# Copy the binaries from the builder image.
COPY --from=builder /go/bin/lncli /bin/
diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh
index f1b747a..f1c5aac 100755
--- a/scripts/verify-install.sh
+++ b/scripts/verify-install.sh
@@ -95,14 +95,20 @@ function import_keys() {
function verify_signatures() {
# Download the JSON of the release itself. That'll contain the release ID we
# need for the next call.
- RELEASE_JSON=$(curl -L -s -H "$HEADER_JSON" "$RELEASE_URL/$VERSION")
+ RELEASE_JSON=$(wget -q --header="$HEADER_JSON" -O - "$RELEASE_URL/$VERSION") || {
+ echo "ERROR: Failed to download release JSON from $RELEASE_URL/$VERSION"
+ exit 1
+ }
TAG_NAME=$(echo $RELEASE_JSON | jq -r '.tag_name')
RELEASE_ID=$(echo $RELEASE_JSON | jq -r '.id')
echo "Release $TAG_NAME found with ID $RELEASE_ID"
# Now download the asset list and filter by the manifest and the signatures.
- ASSETS=$(curl -L -s -H "$HEADER_GH_JSON" "$API_URL/$RELEASE_ID" | jq -c '.assets[]')
+ ASSETS=$(wget -q --header="$HEADER_GH_JSON" -O - "$API_URL/$RELEASE_ID" | jq -c '.assets[]') || {
+ echo "ERROR: Failed to download asset list from $API_URL/$RELEASE_ID"
+ exit 1
+ }
MANIFEST=$(echo $ASSETS | jq -r "$MANIFEST_SELECTOR")
SIGNATURES=$(echo $ASSETS | jq -r "$SIGNATURE_SELECTOR")
@@ -116,11 +122,17 @@ function verify_signatures() {
# Download the main "manifest-*.txt" and all "manifest-*.sig" files containing
# the detached signatures.
echo "Downloading $MANIFEST"
- curl -L -s -o "$TEMP_DIR/$MANIFEST" "$RELEASE_URL/download/$VERSION/$MANIFEST"
+ wget -q -O "$TEMP_DIR/$MANIFEST" "$RELEASE_URL/download/$VERSION/$MANIFEST" || {
+ echo "ERROR: Failed to download $MANIFEST from $RELEASE_URL/download/$VERSION/$MANIFEST"
+ exit 1
+ }
for signature in $SIGNATURES; do
echo "Downloading $signature"
- curl -L -s -o "$TEMP_DIR/$signature" "$RELEASE_URL/download/$VERSION/$signature"
+ wget -q -O "$TEMP_DIR/$signature" "$RELEASE_URL/download/$VERSION/$signature" || {
+ echo "ERROR: Failed to download $signature from $RELEASE_URL/download/$VERSION/$signature"
+ exit 1
+ }
done
echo ""
@@ -267,7 +279,7 @@ shift
verify_version "$VERSION"
# Make sure we have all tools needed for the verification.
-check_command curl
+check_command wget
check_command jq
check_command gpg
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.