Skip to content
This repository has been archived by the owner on Jun 7, 2023. It is now read-only.

feature(desktop): Reenable auto-updater on Windows and enable logging #2650

Merged
merged 5 commits into from
Mar 18, 2020

Conversation

rajivshah3
Copy link
Member

@rajivshah3 rajivshah3 commented Mar 15, 2020

Description

  • Reenable auto-updater on Windows
  • Enable logging for auto-updater

Background

The auto-updater was previously disabled on Windows because a vulnerability in electron-updater allowed code signature verification to be bypassed. This vulnerability was found and disclosed by Luca Carettoni and Lorenzo Stella of Doyensec. While a fix was released by the maintainers of electron-updater, it does not fully mitigate the issue (see electron-userland/electron-builder#4701).

This PR prevents the bypass by aborting the update if code signature verification fails.

Type of change

  • Bug fix (a non-breaking change which fixes an issue)
  • Enhancement (a non-breaking change which adds functionality)

How Has This Been Tested?

  • Tested on Windows 10

Checklist:

  • My code follows the style guidelines for this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas

@rajivshah3 rajivshah3 added T - Bug Type - Bug: Something isn't working T - Enhancement New feature or request C - Desktop E - Security Epic - Security related L - Need reviews Lifecycle - Each PR must have at least two reviewers P - Windows Platform - Specifically relates to Windows labels Mar 15, 2020
@rajivshah3 rajivshah3 merged commit 2f61904 into develop Mar 18, 2020
@rajivshah3 rajivshah3 deleted the fix/win-auto-update branch March 18, 2020 03:43
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
C - Desktop E - Security Epic - Security related L - Need reviews Lifecycle - Each PR must have at least two reviewers P - Windows Platform - Specifically relates to Windows T - Bug Type - Bug: Something isn't working T - Enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants