Skip to content

Conversation

@dapplion
Copy link
Contributor

@dapplion dapplion commented Sep 4, 2021

Verify the release signature status following the specs from #891 and dappnode/DAppNode#332

TODO:

  • Decide the UX (what to do) when a release is not signed and when it's signed by an unknown key.
    • Packages from IPFS without a valid signature are not allowed to install. However, the restriction can be waved with BYPASS_SIGNED_RESTRICTION option
  • Add e2e test uploading a release to IPFS with a signature

Next steps:

  • Add support for more signature protocols

Closes #891


To test this PR:

  1. Install this DAPPMANAGER version
  2. Try to install a package from IPFS (not signed) and expect the DAPPMANAGER to block installation (like with the core restriction)
  3. Expand extra options and tick the "bypass signed restriction" box. Then the DAPPMANAGER must allow installation
  4. Use the UI in this PR Add sign release functionality sdk-publish#3 to sign a release
  5. Go to UI > Advanced > Trusted Release Keys and add the address used to sign the release
  6. DAPPMANAGER must allow installation of the release and display status that it's signed by that known key

@github-actions
Copy link

github-actions bot commented Sep 4, 2021

@github-actions
Copy link

github-actions bot commented Sep 4, 2021

DAppNode bot has built and pinned the release to an IPFS node, for commit: 485c8bf

This is a development version and should only be installed for testing purposes, install link

/ipfs/Qmb2EQrDTiREZSc7E3N9VJWgJMXyKa5XNMMt4Fghv42r72

(by dappnodebot/build-action)

@github-actions github-actions bot temporarily deployed to commit September 5, 2021 12:19 Inactive
@dapplion dapplion force-pushed the dapplion/verify-release-signature branch from 40898e9 to 103e81d Compare September 5, 2021 15:26
@github-actions github-actions bot temporarily deployed to commit September 5, 2021 15:30 Inactive
@github-actions github-actions bot temporarily deployed to commit September 5, 2021 16:18 Inactive
@github-actions github-actions bot temporarily deployed to commit September 5, 2021 17:03 Inactive
@github-actions github-actions bot temporarily deployed to commit September 6, 2021 08:10 Inactive
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 13:40 Inactive
Verify release signature

Update release entries test
@dapplion dapplion force-pushed the dapplion/verify-release-signature branch from cddd5c6 to 741875c Compare October 17, 2021 13:50
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 13:53 Inactive
@dapplion dapplion marked this pull request as ready for review October 17, 2021 14:00
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 14:02 Inactive
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 14:26 Inactive
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 14:37 Inactive
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 15:05 Inactive
@github-actions github-actions bot temporarily deployed to commit October 17, 2021 15:18 Inactive
@dapplion
Copy link
Contributor Author

DAPPMANAGER successfully blocks installation of unsafe packages, but the BYPASS_SIGNED_RESTRICTION does not work. I've tested installing the ssv prater package QmQ4Nv8PE3tfRFVCKosjiyxV5aU4SBp3gviirMaGrBtTjx from IPFS but checking the BYPASS_SIGNED_RESTRICTION box doesn't let you move forward. @pablomendezroyo can you help me investigate?

@github-actions github-actions bot temporarily deployed to commit October 18, 2021 07:05 Inactive
@github-actions github-actions bot temporarily deployed to commit October 18, 2021 07:22 Inactive
@github-actions github-actions bot temporarily deployed to commit October 18, 2021 08:21 Inactive
@github-actions github-actions bot temporarily deployed to commit October 18, 2021 15:28 Inactive
@github-actions github-actions bot temporarily deployed to commit October 18, 2021 15:44 Inactive
@dapplion dapplion merged commit abae205 into master Oct 18, 2021
@dapplion dapplion deleted the dapplion/verify-release-signature branch October 18, 2021 18:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Verify signature.json against IPFS releases

2 participants