Repository navigation
curl need add -L param to install.sh when get gpg key #11138
Description
in these pages:
https://raw.githubusercontent.com/fluent/fluent-bit/master/install.sh
https://docs.fluentbit.io/manual/installation/downloads/linux/debian
https://docs.fluentbit.io/manual/installation/downloads/linux/raspbian-raspberry-pi
https://docs.fluentbit.io/manual/installation/downloads/linux/ubuntu
the curl command will by add -L param to follow 30x location ,
because your https://packages.fluentbit.io/fluentbit.key will be location to https://s3.amazonaws.com/packages.fluentbit.io/fluentbit.key
Activity
JamesParrott commentedon Nov 8, 2025
Thanks Vanni! I wondered why the official installation instructions didn't work. Adding
-Lhelped me get the GPG key on Debian:Vanni-Fan commentedon Nov 10, 2025
The default behavior of curl does not follow 30x. ( but -L param will by follow 30x)
When https://packages.fluentbit.io/fluentbit.key location to https://s3.amazonaws.com/packages.fluentbit.io/fluentbit.key,
curl will obtain an empty content to gpg command.
like this: echo '' | gpg --dearmor, You will receive an error: "no valid OpenPGP data found."
patrick-stephens commentedon Nov 10, 2025
Resolved by #11137
rafaelma commentedon Nov 10, 2025
This can be a security issue.
Not using -L guarantees that the gpg key has to be found in the address defined in the client repo.
Accepting a redirect when getting the repo gpg key does not guarantee that the client is talking with the correct/official repo.
Another important issue with redirects in repo addresses is that they break all system using a proxy to allow the access to the repo from internal infrastructures.