Skip to content

Commit

Permalink
Enforce signature check on library_index.json (#2326)
Browse files Browse the repository at this point in the history
  • Loading branch information
cmaglie authored Sep 20, 2023
1 parent 29c70df commit 28fc9d6
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 3 deletions.
10 changes: 8 additions & 2 deletions arduino/resources/index.go
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ package resources

import (
"context"
"errors"
"net/url"
"path"
"strings"
Expand All @@ -33,8 +34,9 @@ import (

// IndexResource is a reference to an index file URL with an optional signature.
type IndexResource struct {
URL *url.URL
SignatureURL *url.URL
URL *url.URL
SignatureURL *url.URL
EnforceSignatureVerification bool
}

// IndexFileName returns the index file name as it is saved in data dir (package_xxx_index.json).
Expand Down Expand Up @@ -140,6 +142,10 @@ func (res *IndexResource) Download(destDir *paths.Path, downloadCB rpc.DownloadP
} else if !valid {
return &arduino.SignatureVerificationFailedError{File: res.URL.String()}
}
} else {
if res.EnforceSignatureVerification {
return &arduino.PermissionDeniedError{Message: tr("Error verifying signature"), Cause: errors.New(tr("missing signature"))}
}
}

// TODO: Implement a ResourceValidator
Expand Down
3 changes: 2 additions & 1 deletion commands/instances.go
Original file line number Diff line number Diff line change
Expand Up @@ -511,7 +511,8 @@ func UpdateLibrariesIndex(ctx context.Context, req *rpc.UpdateLibrariesIndexRequ
defer tmp.RemoveAll()

indexResource := resources.IndexResource{
URL: librariesmanager.LibraryIndexWithSignatureArchiveURL,
URL: librariesmanager.LibraryIndexWithSignatureArchiveURL,
EnforceSignatureVerification: true,
}
if err := indexResource.Download(lm.IndexFile.Parent(), downloadCB); err != nil {
return err
Expand Down

0 comments on commit 28fc9d6

Please sign in to comment.