8000 Add PREF_CONTRIBUTIONS_TRUST_ALL and download the signature in any case · arduino/Arduino@df5a524 · GitHub
[go: up one dir, main page]
Skip to content

Commit df5a524

Browse files
Mattia Bertorellocmaglie
Mattia Bertorello
authored and
cmaglie
committed
Add PREF_CONTRIBUTIONS_TRUST_ALL and download the signature in any case
1 parent c3fdb10 commit df5a524

File tree

3 files changed

+12
-7
lines changed

3 files changed

+12
-7
lines changed

‎arduino-core/src/cc/arduino/Constants.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ public class Constants {
3737
public static final String PREF_REMOVE_PLACEHOLDER = "___REMOVE___";
3838
public static final String PREF_BOARDS_MANAGER_ADDITIONAL_URLS = "boardsmanager.additional.urls";
3939
public static final String PREF_CONTRIBUTIONS_TRUST_ALL = "contributions.trust.all";
40+
public static final String ALLOW_INSECURE_PACKAGES = "allow_insecure_packages";
4041

4142
public static final String DEFAULT_INDEX_FILE_NAME = "package_index.json";
4243
public static final String BUNDLED_INDEX_FILE_NAME = "package_index_bundled.json";

‎arduino-core/src/cc/arduino/contributions/DownloadableContributionsDownloader.java

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929

3030
package cc.arduino.contributions;
3131

32+
import cc.arduino.Constants;
3233
import cc.arduino.utils.FileHash;
3334
import cc.arduino.utils.MultiStepProgress;
3435
import cc.arduino.utils.Progress;
@@ -199,11 +200,9 @@ public boolean verifyDomain(URL url) {
199200
public boolean checkSignature(MultiStepProgress progress, URL signatureUrl, ProgressListener progressListener, SignatureVerifier signatureVerifier, String statusText, File fileToVerify) throws Exception {
200201

201202
final boolean allowInsecurePackages =
202-
PreferencesData.getBoolean("allow_insecure_packages", false);
203-
if (allowInsecurePackages) {
204-
log.info("Allow insecure packages is true the signature will be skip and return always verified");
205-
return true;
206-
}
203+
PreferencesData.getBoolean(Constants.ALLOW_INSECURE_PACKAGES, false);
204+
final boolean trustAll = PreferencesData.getBoolean(Constants.PREF_CONTRIBUTIONS_TRUST_ALL);
205+
final boolean skipVerification = allowInsecurePackages || trustAll;
207206

208207
// Signature file name
209208
final String signatureFileName = FilenameUtils.getName(signatureUrl.getPath());
@@ -215,6 +214,12 @@ public boolean checkSignature(MultiStepProgress progress, URL signatureUrl, Prog
215214
// Download signature
216215
download(signatureUrl, packageIndexSignatureTemp, progress, statusText, progressListener, true);
217216

217+
if (skipVerification) {
218+
log.info("Allowing insecure packages because allow_insecure_packages is set to true in preferences.txt" +
219+
" but the signature was download");
220+
return true;
221+
}
222+
218223
// Verify the signature before move the files
219224
final boolean signatureVerified = signatureVerifier.isSigned(fileToVerify, packageIndexSignatureTemp);
220225
if (signatureVerified) {

‎arduino-core/src/cc/arduino/contributions/packages/ContributionsIndexer.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@
3333
import cc.arduino.contributions.DownloadableContribution;
3434
import cc.arduino.contributions.SignatureVerificationFailedException;
3535
import cc.arduino.contributions.SignatureVerifier;
36-
3736
import com.fasterxml.jackson.core.JsonProcessingException;
3837
import com.fasterxml.jackson.databind.DeserializationFeature;
3938
import com.fasterxml.jackson.databind.ObjectMapper;
@@ -87,7 +86,7 @@ public void parseIndex() throws Exception {
8786
File defaultIndexFile = getIndexFile(Constants.DEFAULT_INDEX_FILE_NAME);
8887
if (defaultIndexFile.exists()) {
8988
// Check main index signature
90-
if (!PreferencesData.getBoolean("allow_insecure_packages") && !signatureVerifier.isSigned(defaultIndexFile)) {
89+
if (!PreferencesData.getBoolean(Constants.ALLOW_INSECURE_PACKAGES) && !signatureVerifier.isSigned(defaultIndexFile)) {
9190
throw new SignatureVerificationFailedException(Constants.DEFAULT_INDEX_FILE_NAME);
9291
}
9392

0 commit comments

Comments
 (0)
0