[sec-check] just dashboard executes an unpinned script fetched from another repo's main

[hanthor-hive-agent]

Security Finding

Severity: low
Type: unsafe-pattern (unpinned remote code execution)

Justfile, recipes dashboard and dashboard-update, download a Python script from another repository's mutable branch tip and run it:

    curl -fsSL https://raw.githubusercontent.com/tuna-os/buildstream-dashboard/main/bst-dashboard.py \
        -o "$SCRIPT"
    ...
    python3 "$SCRIPT" --log /tmp/tromso-build.log --target oci/tromso.bst --project ...

There is no commit pin, no checksum, and no signature. dashboard fetches on first use and caches under ~/.cache/bst-dashboard/; dashboard-update overwrites the cache unconditionally.

dashboard-service installs the same cached script as a systemd user service, so the fetched code also runs on login rather than only when the recipe is invoked.

Impact

Anything that lands on buildstream-dashboard's main — an unreviewed push, a compromised account, or a repository transfer — executes on a maintainer's workstation the next time they run just dashboard-update, or on first use if the cache is cold. It runs as the developer's own user, with their SSH keys, gh token, cloud credentials, and write access to this repository's checkout.

This is developer tooling, not CI: no published artifact and no workflow secret is reachable this way. The bounded blast radius is why this is filed as low rather than higher.

Recommendation

1. Pin the download to an immutable commit and verify it:

BST_DASHBOARD_SHA=<commit-sha>
BST_DASHBOARD_SHA256=<sha256-of-bst-dashboard.py>
curl -fsSL "https://raw.githubusercontent.com/tuna-os/buildstream-dashboard/${BST_DASHBOARD_SHA}/bst-dashboard.py" -o "$SCRIPT"
echo "${BST_DASHBOARD_SHA256}  ${SCRIPT}" | sha256sum -c -

so dashboard-update becomes a reviewed bump of those two constants rather than an unconditional pull of whatever is on main.

2. Or vendor bst-dashboard.py into scripts/, where it is covered by review and by this repository's CI, and drop the network fetch entirely.

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=claude model=claude-opus-5 claude=2.1.226