feat: forkify urls.#907
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # Cross-platform installer for Helix CLI | ||
|
|
||
| readonly REPO="HelixDB/helix-db" | ||
| readonly REPO="CloudForge-Solutions/openhelix" |
There was a problem hiding this comment.
The REPO variable now points to CloudForge-Solutions/openhelix instead of the canonical HelixDB/helix-db. The install script fetches GitHub Release assets (binary tarballs) from this repo and executes them. Any user who runs curl … | bash after this change is merged would download and run binaries published by an unverified third party, giving that party full code-execution on the installer's machine. This is a textbook supply-chain attack vector.
|
|
||
| const CURRENT_VERSION: &str = env!("CARGO_PKG_VERSION"); | ||
| const GITHUB_API_URL: &str = "https://api.github.com/repos/helixdb/helix-db/releases/latest"; | ||
| const GITHUB_API_URL: &str = "https://api.github.com/repos/cloudforge-solutions/openhelix/releases/latest"; |
There was a problem hiding this comment.
GITHUB_API_URL now queries cloudforge-solutions/openhelix for the latest release. The update flow uses this URL to download and replace the running helix binary. If the third-party repo publishes a malicious release, every existing user who triggers an auto-update silently installs that payload without any user interaction. This must point to the official HelixDB/helix-db releases API.
| // Development flag - set to true when working on V2 locally | ||
| const DEV_MODE: bool = cfg!(debug_assertions); | ||
| const HELIX_REPO_URL: &str = "https://github.com/helixdb/helix-db.git"; | ||
| const HELIX_REPO_URL: &str = "https://github.com/cloudforge-solutions/openhelix.git"; |
There was a problem hiding this comment.
HELIX_REPO_URL is used to git clone the database source during a helix build. Pointing it to cloudforge-solutions/openhelix means the compiled binary could come from code that diverges from (or entirely replaces) the official HelixDB codebase, with no transparency to the end user.
|
|
||
| /// The base URL for creating new GitHub issues. | ||
| pub const GITHUB_ISSUE_URL: &str = "https://github.com/helixdb/helix-db/issues/new"; | ||
| pub const GITHUB_ISSUE_URL: &str = "https://github.com/cloudforge-solutions/openhelix/issues/new"; |
There was a problem hiding this comment.
GITHUB_ISSUE_URL now opens issues against cloudforge-solutions/openhelix. Users filing bug reports through the CLI will unknowingly send their system info, stack traces, and query details to a third-party repo, and those reports will never be seen by the HelixDB maintainers.
|
|
||
| ### Reporting Issues | ||
| - Check existing [GitHub Issues](https://github.com/HelixDB/helix-db/issues) to avoid duplicates | ||
| - Check existing [GitHub Issues](https://github.com/CloudForge-Solutions/openhelix/issues) to avoid duplicates |
There was a problem hiding this comment.
The contributing guide now tells contributors to clone CloudForge-Solutions/openhelix and file issues there. Contributors following this guide will fork and push to a third-party repo rather than the official project, fragmenting contributions away from HelixDB/helix-db.
| [](https://github.com/CloudForge-Solutions/openhelix/stargazers) | ||
| [](https://discord.gg/2stgMPr5BD) |
There was a problem hiding this comment.
Both the GitHub stars badge and the Lines-of-Code badge now reference CloudForge-Solutions/openhelix. Visitors to the official repo will see misleading (likely zero or wrong) counts that reflect a completely different project.
1 participant
Description
Related Issues
Closes #
Checklist when merging to main
rustfmthelix-cli/Cargo.tomlandhelixdb/Cargo.tomlAdditional Notes
Greptile Summary
This PR replaces every reference to the canonical
HelixDB/helix-dbrepository withCloudForge-Solutions/openhelixacross documentation, Rust source, shell scripts, and Cargo manifests. This PR must not be merged — three of the changed files control where binaries are downloaded and executed (install script, auto-updater, build source clone), making this a direct supply-chain attack vector against all current and future HelixDB users.helix-cli/install.shandsrc/update.rs(P0): The install script and auto-update checker now fetch release binaries from an unverified third-party GitHub repo; any user who installs or updates HelixDB after this change would execute code published outside the official project.src/commands/build.rs(P0):helix buildclones source fromcloudforge-solutions/openhelixinstead of the official repo, so the compiled database binary could come from an unaudited codebase.CONTRIBUTORS.md,README.md, all threeCargo.tomlfiles, and several.hxtest comment headers redirect contributors, crates.io visitors, and bug reporters away from the official project.Security Review
install.sh):REPOchanged toCloudForge-Solutions/openhelix. The install script fetches and executes GitHub Release binaries from this third-party repo, giving it full code-execution on every new installer's machine.update.rs):GITHUB_API_URLredirected tocloudforge-solutions/openhelix/releases/latest. Existing users who trigger auto-updates silently replace thehelixbinary with one published by an unverified party.build.rs):HELIX_REPO_URLnow clones source fromcloudforge-solutions/openhelix, meaninghelix buildcompiles and installs code from outside the audited HelixDB codebase.github_issue.rs): Bug reports (including system info and stack traces) are sent to an external GitHub repo controlled by a third party.Important Files Changed
Flowchart
%%{init: {'theme': 'neutral'}}%% flowchart TD A[User runs install.sh] --> B{REPO source} B -->|Before PR| C[HelixDB/helix-db\nGitHub Releases] B -->|After PR ⚠️| D[CloudForge-Solutions/openhelix\nGitHub Releases] E[User runs helix update] --> F{GITHUB_API_URL} F -->|Before PR| G[api.github.com/repos/helixdb/helix-db] F -->|After PR ⚠️| H[api.github.com/repos/cloudforge-solutions/openhelix] I[User runs helix build] --> J{HELIX_REPO_URL} J -->|Before PR| K[github.com/helixdb/helix-db.git] J -->|After PR ⚠️| L[github.com/cloudforge-solutions/openhelix.git] M[User files issue via CLI] --> N{GITHUB_ISSUE_URL} N -->|Before PR| O[github.com/helixdb/helix-db/issues] N -->|After PR ⚠️| P[github.com/cloudforge-solutions/openhelix/issues] style D fill:#ff4444,color:#fff style H fill:#ff4444,color:#fff style L fill:#ff4444,color:#fff style P fill:#ffaa00,color:#fffReviews (1): Last reviewed commit: "feat: forkify urls." | Re-trigger Greptile