labscript

bash

#!/usr/bin/env bash
set -euo pipefail

# payload criptografado (base64). Público, mas inútil sem a senha.
BLOB='U2FsdGVkX19mynAe4q5IDtryMHMXQ04WnQvQPEJq4Is='

# --- acha um openssl que suporte -pbkdf2 (LibreSSL antigo do macOS não suporta) ---
pick_openssl() {
  for c in openssl \
           /opt/homebrew/opt/openssl@3/bin/openssl \
           /usr/local/opt/openssl@3/bin/openssl \
           /opt/homebrew/bin/openssl \
           /usr/local/bin/openssl; do
    if command -v "$c" >/dev/null 2>&1 \
       && echo x | "$c" enc -aes-256-cbc -pbkdf2 -iter 1 -pass pass:x >/dev/null 2>&1; then
      printf '%s' "$c"; return 0
    fi
  done
  return 1
}

OSSL="$(pick_openssl)" || {
  printf 'Erro: nenhum openssl com suporte a -pbkdf2 encontrado.\n' > /dev/tty
  printf 'No macOS antigo: brew install openssl@3\n' > /dev/tty
  exit 1
}

# --- lê a senha do TERMINAL (/dev/tty), não do stdin (que é o pipe do curl) ---
printf 'Senha: ' > /dev/tty
read -rs PASS < /dev/tty
printf '\n' > /dev/tty

# --- decode + decrypt + exec (senha via fd:3 pra não vazar no ps) ---
printf '%s' "$BLOB" \
  | "$OSSL" enc -d -aes-256-cbc -md sha256 -iter 200000 -pbkdf2 -a -A \
      -pass fd:3 3< <(printf '%s' "$PASS") \
  | bash