Verify integrity of downloaded update #96
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
This verifies the integrity of the downloaded update using OpenSSL. The certificate is the one that we also use for the regular code signing. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
|
Let me adjust the integration tests here so that they have valid signatures. |
LukasReschke
force-pushed
the
verify-integrity
branch
2 times, most recently
from
9d38457
to
b585e3d
Compare
LukasReschke
force-pushed
the
verify-integrity
branch
from
b585e3d
to
5bf5e00
Compare
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
LukasReschke
force-pushed
the
verify-integrity
branch
from
5bf5e00
to
50ea185
Compare
Due to bug nextcloud/server#4362 Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
MorrisJobke
approved these changes
Apr 17, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This can be easily tested by installing Nextcloud 11.0.1 and then executing the updater. Make sure to change the channel before to invalidate the cache.
On the regular updater server this should fail as no valid signature is set. On the https://updates.nextcloud.com/internal_updater_server/ one this should work, to configure it:
occ config:system:set --value "https://updates.nextcloud.com/internal_updater_server/" updater.server.urlNote that OpenSSL is already a hard-dependency in the server.