Verify setup authenticity during update

[hugbug]

When installing update via built-in update routine (Windows and Linux installers) the program downloads new setup from NZBGet download area.

The downloaded file must be verified before execution.

• develop signing mechanism with public/private keys;
• implement verification routine in NZBGet for usage from update scripts;
• create a build script to generate file with signatures;
• provide hosting for file with signatures;
• include public key into Windows setup;
• include public key into Linux installer;
• put link to signatures files into update info file;
• implement verification in Windows update script;
• implement verification in Linux update script.

[hugbug]

Intro

Both Windows version and Linux version are compiled using OpenSSL. The verification mechanism must use OpenSSL functionality. This is because the update scripts cannot rely on any external programs such as GnuPG or similar. We can't expect those programs to exist on every system.

OpenSSL provides functions for signing and verification. During signing process we can use openssl-binary, which we can expect to be installed on the build machine. The verification must be implemented in NZBGet.

Create private key

openssl genrsa -out privkey.pem 2048

Export public key

openssl rsa -in privkey.pem -outform PEM -pubout -out pubkey.pem

Signing

openssl dgst -sha256 -sign privkey.pem -out installer-package.sig installer-package

Verifying

openssl dgst -sha256 -verify pubkey.pem -signature installer-package.sig installer-package

Verification in NZBGet

What command openssl dgst -verify does can be implemented in NZBGet using function RSA_verify.
Example code: http://sehermitage.web.fc2.com/program/src/rsacrypt.c

[hugbug]

Signatures are available for download from releases page. For example for v15.0 the file with signatures is nzbget-15.0.sig.txt. It includes hashes each hosted files:

• MD5;
• SHA1;
• SHA256;
• RSA-SHA256 - signed with RSA certificate. Can be verified using pubkey.pem.