fix: address code review — bug fixes, CI hardening, dedup helper

* Extract config/fetch-gh-release.sh helper; 6 Dockerfile RUN blocks
  (opengrep, cutter, ghidra, retdec, imhex, pwninit) now call it
  instead of repeating curl+jq+wget+empty-check inline.
* MOTD: echo '\n...' → printf so newlines render in /etc/motd.
* IDA Free: replace dead regex check with `file ... | grep ELF`
  and add post-install ida64 binary check.
* Ghidra: replace `mv /opt/ghidra_*` glob with explicit `find`
  plus ghidraRun executable check.
* Binary Ninja: add existence check before symlink.
* retdec: validate /opt/retdec/bin exists and only symlink
  actual executables; error if none found.
* zsh_history: COPY moved after oh-my-zsh install with --chown
  so the installer can't overwrite the pre-populated history.
* MOTD: rephrase decomp2dbg note (not installed; user installs).
* Set PWNDBG_NO_AUTOUPDATE=1 — /opt/pwndbg is root-owned, so the
  ctf user otherwise sees a "Permission denied" wall on every
  gdb-pwndbg launch.

CI:
* New shellcheck step via ludeeus/action-shellcheck.
* Trivy vuln scan (HIGH/CRITICAL, ignore-unfixed) after smoke test.
* Smoke test now functionally invokes each tool (r2 -qv, pwn
  checksec, pwntools/capstone/keystone/unicorn import via the pipx
  venv python, gdb-multiarch -nx --batch, gdb-pwndbg --batch).

Docs:
* README: new "Security & Trade-offs" section covering passwordless
  sudo, unpinned git plugins, and the Wayback IDA snapshot.
* README: fix checksec example (apt pkg not installed) → pwn checksec;
  same fix in config/zsh_history.
* README: remove duplicate pwninit row; add ImHex to GUI tools list.
* config/gdbinit: one-line purpose comment.

Author: gl0bal01

.github/workflows/build.yml

@@ -32,6 +32,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Lint shell scripts
+        uses: ludeeus/action-shellcheck@2.0.0
+        with:
+          scandir: config
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -74,19 +79,49 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Smoke test
+        # Verify tools are present AND actually invokable. A corrupted ELF
+        # would pass `command -v` but fail `--version`; this catches that.
         run: |
           set -euo pipefail
           docker run --rm smoke-test:local bash -c '
             set -eo pipefail
             for bin in pwn gdb-pwndbg gdb-gef gdb-peda r2 rizin ghidra \
                        ROPgadget ropper afl-fuzz frida one_gadget \
                        opengrep pwninit cutter ida64 binaryninja \
-                       pycdc jd-gui binwalk; do
+                       pycdc jd-gui binwalk imhex; do
               command -v "$bin" >/dev/null || { echo "MISSING: $bin"; exit 1; }
             done
+            # Functional checks (only quick, non-interactive invocations)
+            r2 -qv >/dev/null
+            rizin -qv >/dev/null
+            opengrep --version >/dev/null
+            pwninit --help >/dev/null
+            one_gadget --version >/dev/null
+            ROPgadget --version >/dev/null
+            # afl-fuzz -h exits non-zero AND grep -q closes the pipe early
+            # (SIGPIPE), so wrap to satisfy `set -eo pipefail`.
+            ( afl-fuzz -h 2>&1 || true ) | grep -qi afl
+            pwn version >/dev/null
+            pwn checksec /bin/ls >/dev/null
+            # pwntools lives in its pipx venv; bare python3 cannot import it.
+            /opt/pipx/venvs/pwntools/bin/python -c "from pwn import *; from capstone import *; from keystone import *; from unicorn import *"
+            # -nx skips ~/.gdbinit so we test gdb itself, not the pwndbg plugin.
+            gdb-multiarch -nx --batch -ex quit >/dev/null
+            # Loads the pwndbg plugin to confirm it imports cleanly.
+            gdb-pwndbg --batch -ex quit >/dev/null
             echo "Smoke test passed"
           '
 
+      - name: Trivy vulnerability scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          image-ref: smoke-test:local
+          format: table
+          exit-code: "1"
+          ignore-unfixed: true
+          severity: HIGH,CRITICAL
+          vuln-type: os,library
+
       # Only pushes after smoke test succeeds. Cache hit from build_local means
       # this is near-instant even though build-push-action re-runs buildx.
       - name: Push to GHCR

Dockerfile

@@ -58,14 +58,14 @@ RUN git clone --depth=1 https://github.com/blackploit/hash-identifier /opt/hash-
     && ln -s /opt/hash-identifier/hash-id.py /usr/local/bin/hash-identifier \
     && chmod +x /opt/hash-identifier/hash-id.py
 
+# Helper script shared by GitHub release downloads (see config/fetch-gh-release.sh)
+COPY config/fetch-gh-release.sh /usr/local/bin/fetch-gh-release.sh
+RUN chmod +x /usr/local/bin/fetch-gh-release.sh
+
 RUN --mount=type=secret,id=github_token \
-    tok=$(cat /run/secrets/github_token 2>/dev/null || true); \
-    curl_auth=(); [ -z "$tok" ] || curl_auth=(-H "Authorization: token ${tok}"); \
-    url=$(curl -fsSL "${curl_auth[@]}" https://api.github.com/repos/opengrep/opengrep/releases/latest \
-        | jq -er '.assets[] | select(.name == "opengrep_manylinux_x86") | .browser_download_url' | head -1); \
-    [ -n "$url" ] || { echo "ERROR: opengrep asset URL not found"; exit 1; }; \
-    wget -qO /usr/local/bin/opengrep "$url"; \
-    [ -s /usr/local/bin/opengrep ] || { echo "ERROR: opengrep download empty"; exit 1; }; \
+    fetch-gh-release.sh opengrep/opengrep \
+        '.assets[] | select(.name == "opengrep_manylinux_x86") | .browser_download_url' \
+        /usr/local/bin/opengrep; \
     chmod +x /usr/local/bin/opengrep; \
     /usr/local/bin/opengrep --version >/dev/null || { echo "ERROR: opengrep binary invalid"; exit 1; }
 
@@ -103,13 +103,9 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 
 # Cutter (rizin GUI) — extracted AppImage for Docker compatibility
 RUN --mount=type=secret,id=github_token \
-    tok=$(cat /run/secrets/github_token 2>/dev/null || true); \
-    curl_auth=(); [ -z "$tok" ] || curl_auth=(-H "Authorization: token ${tok}"); \
-    url=$(curl -fsSL "${curl_auth[@]}" https://api.github.com/repos/rizinorg/cutter/releases/latest \
-        | jq -er '.assets[] | select(.name | test("Linux-x86_64\\.AppImage$")) | .browser_download_url' | head -1); \
-    [ -n "$url" ] || { echo "ERROR: Cutter asset URL not found"; exit 1; }; \
-    wget -qO /tmp/cutter.AppImage "$url"; \
-    [ -s /tmp/cutter.AppImage ] || { echo "ERROR: Cutter download empty"; exit 1; }; \
+    fetch-gh-release.sh rizinorg/cutter \
+        '.assets[] | select(.name | test("Linux-x86_64\\.AppImage$")) | .browser_download_url' \
+        /tmp/cutter.AppImage; \
     file /tmp/cutter.AppImage | grep -q ELF || { echo "ERROR: Cutter not an ELF"; exit 1; }; \
     chmod +x /tmp/cutter.AppImage; \
     cd /tmp && ./cutter.AppImage --appimage-extract; \
@@ -119,40 +115,45 @@ RUN --mount=type=secret,id=github_token \
 
 # Ghidra (platform-independent zip)
 RUN --mount=type=secret,id=github_token \
-    tok=$(cat /run/secrets/github_token 2>/dev/null || true); \
-    curl_auth=(); [ -z "$tok" ] || curl_auth=(-H "Authorization: token ${tok}"); \
-    url=$(curl -fsSL "${curl_auth[@]}" https://api.github.com/repos/NationalSecurityAgency/ghidra/releases/latest \
-        | jq -er '.assets[] | select(.name | endswith(".zip")) | select(.name | test("PUBLIC")) | .browser_download_url' | head -1); \
-    [ -n "$url" ] || { echo "ERROR: Ghidra asset URL not found"; exit 1; }; \
-    wget -qO /tmp/ghidra.zip "$url"; \
-    [ -s /tmp/ghidra.zip ] || { echo "ERROR: Ghidra download empty"; exit 1; }; \
+    fetch-gh-release.sh NationalSecurityAgency/ghidra \
+        '.assets[] | select(.name | endswith(".zip")) | select(.name | test("PUBLIC")) | .browser_download_url' \
+        /tmp/ghidra.zip; \
     unzip -tq /tmp/ghidra.zip || { echo "ERROR: Ghidra zip corrupt"; exit 1; }; \
     unzip -q /tmp/ghidra.zip -d /opt; \
-    mv /opt/ghidra_* /opt/ghidra; \
+    ghidra_dir=$(find /opt -maxdepth 1 -mindepth 1 -type d -name 'ghidra_*' -print -quit); \
+    [ -n "$ghidra_dir" ] || { echo "ERROR: Ghidra extracted dir not found"; exit 1; }; \
+    mv "$ghidra_dir" /opt/ghidra; \
+    [ -x /opt/ghidra/ghidraRun ] || { echo "ERROR: ghidraRun missing or not executable"; exit 1; }; \
     ln -s /opt/ghidra/ghidraRun /usr/local/bin/ghidra; \
     rm /tmp/ghidra.zip
 
-# retdec (pre-built, no wrapper dir in archive)
+# retdec — ships bare binaries in bin/; extract and symlink each into PATH
 RUN --mount=type=secret,id=github_token \
     mkdir -p /opt/retdec; \
-    tok=$(cat /run/secrets/github_token 2>/dev/null || true); \
-    curl_auth=(); [ -z "$tok" ] || curl_auth=(-H "Authorization: token ${tok}"); \
-    url=$(curl -fsSL "${curl_auth[@]}" https://api.github.com/repos/avast/retdec/releases/latest \
-        | jq -er '.assets[] | select(.name | test("[Ll]inux.*tar")) | .browser_download_url' | head -1); \
-    [ -n "$url" ] || { echo "ERROR: retdec asset URL not found"; exit 1; }; \
-    wget -qO /tmp/retdec.tar.xz "$url"; \
-    [ -s /tmp/retdec.tar.xz ] || { echo "ERROR: retdec download empty"; exit 1; }; \
+    fetch-gh-release.sh avast/retdec \
+        '.assets[] | select(.name | test("[Ll]inux.*tar")) | .browser_download_url' \
+        /tmp/retdec.tar.xz; \
     tar tf /tmp/retdec.tar.xz >/dev/null || { echo "ERROR: retdec archive corrupt"; exit 1; }; \
     tar xf /tmp/retdec.tar.xz -C /opt/retdec; \
-    ln -s /opt/retdec/bin/* /usr/local/bin/; \
+    [ -d /opt/retdec/bin ] || { echo "ERROR: retdec bin/ dir missing"; exit 1; }; \
+    found=0; for f in /opt/retdec/bin/*; do \
+        [ -f "$f" ] && [ -x "$f" ] || continue; \
+        ln -s "$f" "/usr/local/bin/$(basename "$f")"; \
+        found=1; \
+    done; \
+    [ "$found" = "1" ] || { echo "ERROR: no executable retdec binaries to symlink"; exit 1; }; \
     rm /tmp/retdec.tar.xz
 
 # IDA Free (Wayback archive — original URL removed by Hex-Rays)
+# Installer ships as a bare ELF executable. Validate ELF + size so we fail
+# loudly if Wayback returns an HTML error page instead of the binary.
 RUN wget -qO /tmp/idafree_linux.run "https://web.archive.org/web/20240921184600if_/https://out7.hex-rays.com/files/idafree84_linux.run"; \
     [ -s /tmp/idafree_linux.run ] || { echo "ERROR: IDA Free download empty (Wayback may be unavailable)"; exit 1; }; \
-    head -c4 /tmp/idafree_linux.run | grep -q '^.ELF' || [ "$(stat -c%s /tmp/idafree_linux.run)" -gt 10000000 ] || { echo "ERROR: IDA Free installer looks invalid"; exit 1; }; \
+    file /tmp/idafree_linux.run | grep -q 'ELF .* executable' || { echo "ERROR: IDA Free installer is not an ELF (Wayback returned HTML?)"; exit 1; }; \
+    [ "$(stat -c%s /tmp/idafree_linux.run)" -gt 10000000 ] || { echo "ERROR: IDA Free installer too small"; exit 1; }; \
     chmod +x /tmp/idafree_linux.run; \
     /tmp/idafree_linux.run --mode unattended --prefix /opt/idafree; \
+    [ -x /opt/idafree/ida64 ] || { echo "ERROR: IDA Free ida64 missing after install"; exit 1; }; \
     ln -s /opt/idafree/ida64 /usr/local/bin/ida64; \
     rm /tmp/idafree_linux.run
 
@@ -161,20 +162,17 @@ RUN wget -qO /tmp/binaryninja_free.zip "https://cdn.binary.ninja/installers/bina
     [ -s /tmp/binaryninja_free.zip ] || { echo "ERROR: Binary Ninja download empty"; exit 1; }; \
     unzip -tq /tmp/binaryninja_free.zip || { echo "ERROR: Binary Ninja zip corrupt"; exit 1; }; \
     unzip -q /tmp/binaryninja_free.zip -d /opt; \
+    [ -x /opt/binaryninja/binaryninja ] || { echo "ERROR: Binary Ninja binary missing at /opt/binaryninja/binaryninja (archive layout changed?)"; exit 1; }; \
     ln -s /opt/binaryninja/binaryninja /usr/local/bin/binaryninja; \
     rm /tmp/binaryninja_free.zip
 
 # ImHex (hex editor for RE)
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt/lists,sharing=locked \
     --mount=type=secret,id=github_token \
-    tok=$(cat /run/secrets/github_token 2>/dev/null || true); \
-    curl_auth=(); [ -z "$tok" ] || curl_auth=(-H "Authorization: token ${tok}"); \
-    url=$(curl -fsSL "${curl_auth[@]}" https://api.github.com/repos/WerWolv/ImHex/releases/latest \
-        | jq -er '.assets[] | select(.name | test("Ubuntu.*24\\.04.*\\.deb$")) | .browser_download_url' | head -1); \
-    [ -n "$url" ] || { echo "ERROR: ImHex asset URL not found"; exit 1; }; \
-    wget -qO /tmp/imhex.deb "$url"; \
-    [ -s /tmp/imhex.deb ] || { echo "ERROR: ImHex download empty"; exit 1; }; \
+    fetch-gh-release.sh WerWolv/ImHex \
+        '.assets[] | select(.name | test("Ubuntu.*24\\.04.*\\.deb$")) | .browser_download_url' \
+        /tmp/imhex.deb; \
     dpkg-deb -I /tmp/imhex.deb >/dev/null || { echo "ERROR: ImHex deb corrupt"; exit 1; }; \
     apt-get update && apt-get install -y --no-install-recommends /tmp/imhex.deb; \
     rm /tmp/imhex.deb
@@ -224,13 +222,9 @@ RUN git clone --depth=1 https://github.com/niklasb/libc-database /opt/libc-datab
 
 # pwninit
 RUN --mount=type=secret,id=github_token \
-    tok=$(cat /run/secrets/github_token 2>/dev/null || true); \
-    curl_auth=(); [ -z "$tok" ] || curl_auth=(-H "Authorization: token ${tok}"); \
-    url=$(curl -fsSL "${curl_auth[@]}" https://api.github.com/repos/io12/pwninit/releases/latest \
-        | jq -er '.assets[] | select(.name == "pwninit") | .browser_download_url' | head -1); \
-    [ -n "$url" ] || { echo "ERROR: pwninit asset URL not found"; exit 1; }; \
-    wget -qO /usr/local/bin/pwninit "$url"; \
-    [ -s /usr/local/bin/pwninit ] || { echo "ERROR: pwninit download empty"; exit 1; }; \
+    fetch-gh-release.sh io12/pwninit \
+        '.assets[] | select(.name == "pwninit") | .browser_download_url' \
+        /usr/local/bin/pwninit; \
     file /usr/local/bin/pwninit | grep -q ELF || { echo "ERROR: pwninit not an ELF"; exit 1; }; \
     chmod +x /usr/local/bin/pwninit
 
@@ -245,19 +239,32 @@ RUN { userdel -r ubuntu 2>/dev/null || true; } \
     && mkdir -p /ctf && chown ctf:ctf /ctf
 
 # MOTD with post-build notes
-RUN echo '\n=== pwndocker-reverse ===\nNote: Run "decomp2dbg --install" for Ghidra/Cutter GDB integration.\nUse "gdb-switch {pwndbg|gef|peda}" to change default GDB plugin.\n' > /etc/motd
-
-# Layer 12: Config files and helper scripts
-COPY config/zsh_history /home/ctf/.zsh_history
+RUN printf '%s\n' \
+        '' \
+        '=== pwndocker-reverse ===' \
+        'Note: install decomp2dbg yourself ("pipx install decomp2dbg && decomp2dbg --install") for Ghidra/Cutter GDB integration.' \
+        'Use "gdb-switch {pwndbg|gef|peda}" to change default GDB plugin.' \
+        '' > /etc/motd
+
+# Layer 12: GUI launchers
 COPY config/start-cutter.sh config/start-ghidra.sh /usr/local/bin/
-RUN chown ctf:ctf /home/ctf/.zsh_history \
-    && chmod +x /usr/local/bin/start-cutter.sh /usr/local/bin/start-ghidra.sh
+RUN chmod +x /usr/local/bin/start-cutter.sh /usr/local/bin/start-ghidra.sh
+
+# pwndbg's gdbinit.py runs `uv pip install --reinstall` on every launch
+# when the install dir is read-only for the calling user, which prints a
+# scary "Permission denied" error. /opt/pwndbg is owned by root (built in
+# layer 7), so the ctf user always hits this. Disable the auto-update.
+ENV PWNDBG_NO_AUTOUPDATE=1
 
 USER ctf
 
 # oh-my-zsh
 RUN sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended
 
+# Pre-populated history (copied AFTER oh-my-zsh install so the installer
+# cannot overwrite it). --chown avoids a separate root chown step.
+COPY --chown=ctf:ctf config/zsh_history /home/ctf/.zsh_history
+
 # Set default GDB plugin to pwndbg
 RUN gdb-switch pwndbg
 

README.md

@@ -72,7 +72,7 @@ docker buildx imagetools inspect ghcr.io/gl0bal01/pwndocker-reverse:latest --for
 | **Hex Editors** | ImHex, hexedit |
 | **Fuzzing** | AFL++ |
 | **Dynamic** | frida, strace, ltrace, villoc |
-| **Workflow** | libc-database, pwninit, patchelf, binwalk, unblob, upx |
+| **Workflow** | libc-database, patchelf, binwalk, unblob, upx |
 | **Analysis** | binary-refinery, opengrep, hash-identifier |
 | **Networking** | socat, ncat, tcpdump, tshark, nmap |
 | **Editors** | vim, neovim |
@@ -87,7 +87,7 @@ docker buildx imagetools inspect ghcr.io/gl0bal01/pwndocker-reverse:latest --for
 docker run -it --rm --cap-add=SYS_PTRACE -v $(pwd):/ctf pwndocker-reverse
 
 # Analyze the binary
-checksec --file=./challenge
+pwn checksec ./challenge
 file ./challenge
 strings -n 8 ./challenge
 r2 -A ./challenge
@@ -116,7 +116,7 @@ gdb-peda ./binary          # launch with PEDA
 gdb-switch pwndbg          # set default for plain `gdb`
 ```
 
-### GUI tools (Ghidra, IDA, Cutter, Binary Ninja, jd-gui)
+### GUI tools (Ghidra, IDA, Cutter, Binary Ninja, jd-gui, ImHex)
 
 Requires X11 forwarding. On Linux this works natively; on macOS install [XQuartz](https://www.xquartz.org/), on Windows install [VcXsrv](https://sourceforge.net/projects/vcxsrv/) or use WSLg.
 
@@ -132,6 +132,7 @@ ida64 ./binary                 # launch IDA Free
 binaryninja ./binary           # launch Binary Ninja Free
 start-cutter.sh ./binary       # launch Cutter (checks $DISPLAY)
 jd-gui ./app.jar               # launch Java decompiler
+imhex ./binary                 # launch ImHex (hex editor)
 ```
 
 ### Disassemblers (CLI)
@@ -204,6 +205,16 @@ tshark -r capture.pcap                                  # analyze pcap
 
 Hit Ctrl+R and search. 78 commands covering all installed tools are already in your history -- no need to remember syntax.
 
+## Security & Trade-offs
+
+This image is built for **local CTF use**, not for hosting as a shared service. Three deliberate trade-offs to be aware of:
+
+- **Passwordless sudo for `ctf`.** The `ctf` user has `NOPASSWD:ALL` so contestants can `apt-get install` extra packages mid-CTF. There is no privilege boundary inside the container — only the Docker isolation around it. Do **not** expose this container as a network service (e.g., via `socat`/`ncat`) without dropping sudo first.
+- **GDB plugins (pwndbg, GEF, PEDA) and a few other git-cloned tools track the latest default branch.** This keeps the image fresh as CTF tooling evolves; the **weekly CI rebuild + smoke test** catches upstream breakage. The remaining risk is a malicious upstream commit shipping straight into a rebuild — pin a specific image digest (see *Reproducibility & Verification* above) if that's a concern.
+- **IDA Free is fetched from a Wayback Machine snapshot** because Hex-Rays removed v8.4 from their CDN. The build validates that the downloaded blob is an ELF executable of plausible size, but cannot SHA-pin without access to the original asset. If the snapshot ever disappears the build fails loudly rather than silently producing a broken image.
+
+CI runs **Trivy** against every build (fails on HIGH/CRITICAL OS/library CVEs with fixes available) and **shellcheck** on every shipped shell script, so regressions in either dimension block the push.
+
 ## Project Structure
 
 ```
@@ -213,6 +224,8 @@ config/
   gdb-gef                # GDB launcher (GEF)
   gdb-peda               # GDB launcher (PEDA)
   gdb-switch             # Set default GDB plugin
+  gdbinit                # Shared GDB plugin init (loaded by wrappers)
+  fetch-gh-release.sh    # GitHub release asset fetcher (shared in Dockerfile)
   jd-gui                 # java -jar wrapper
   start-cutter.sh        # GUI launcher with $DISPLAY check
   start-ghidra.sh        # GUI launcher with $DISPLAY check

config/fetch-gh-release.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Fetch a GitHub release asset URL through the API and download it.
+# Reads optional auth token from /run/secrets/github_token (BuildKit secret).
+# Usage: fetch-gh-release.sh <owner/repo> <jq-filter> <output-path>
+#   <jq-filter> must yield browser_download_url string(s); first match used.
+set -eo pipefail
+
+repo=${1:?repo required}
+filter=${2:?jq filter required}
+out=${3:?output path required}
+
+tok=$(cat /run/secrets/github_token 2>/dev/null || true)
+auth=()
+[ -z "$tok" ] || auth=(-H "Authorization: token ${tok}")
+
+url=$(curl -fsSL "${auth[@]}" "https://api.github.com/repos/${repo}/releases/latest" \
+        | jq -er "${filter}" | head -1)
+[ -n "$url" ] || { echo "ERROR: ${repo} asset URL not found"; exit 1; }
+
+wget -qO "$out" "$url"
+[ -s "$out" ] || { echo "ERROR: ${repo} download empty"; exit 1; }

config/gdbinit

@@ -1,3 +1,4 @@
+# GDB plugin init — each define loads one plugin on demand via init-<name>.
 define init-pwndbg
   source /opt/pwndbg/gdbinit.py
 end

config/zsh_history

@@ -1,5 +1,5 @@
 # === Reconnaissance & Analysis ===
-checksec --file=./binary
+pwn checksec ./binary
 file ./binary
 strings -n 8 ./binary
 strings -e l ./binary