Always require signatures for prepackaged plugins (#31785)
* Always require signatures for prepackaged plugins We have always required signatures for packages installed via the marketplace -- whether remotely satisfied, or sourced from the prepackaged plugin cache. However, prepackaged plugins discovered and automatically installed on startup did not require a valid signature. Since we already ship signatures for all Mattermost-authored prepackaged plugins, it's easy to simply start requiring this. Distributions of Mattermost that bundle their own prepackaged plugins will have to include their own signatures. This in turn requires distributing and configuring Mattermost with a custom public key via `PluginSettings.SignaturePublicKeyFiles`. Note that this enhanced security is neutered with a deployment that uses a file-based `config.json`, as any exploit that allows appending to the prepackaged plugins cache probably also allows modifying `config.json` to register a new public key. A [database-based config](https://docs.mattermost.com/configure/configuration-in-your-database.html) is recommended. Finally, we already support an optional setting `PluginSettings.RequirePluginSignature` to always require a plugin signature, although this effectively disables plugin uploads and requires extra effort to deploy the corresponding signature. In environments where only prepackaged plugins are used, this setting is ideal. Fixes: https://mattermost.atlassian.net/browse/MM-64627 * setup dev key, expect no plugins if sig fails * Fix shadow variable errors in test helpers Pre-declare signaturePublicKey variable in loops to avoid shadowing the outer err variable used in error handling. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * Replace PrepackagedPlugin.Signature with SignaturePath for memory efficiency - Changed PrepackagedPlugin struct to use SignaturePath string instead of Signature []byte - Updated buildPrepackagedPlugin to use file descriptor instead of reading signature into memory - Modified plugin installation and persistence to read from signature file paths - Updated all tests to check SignaturePath instead of Signature field - Removed unused bytes import from plugin.go This change reduces memory usage by storing file paths instead of signature data in memory while maintaining the same security verification functionality. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
Этот коммит содержится в:
Jesse Hallam
коммит произвёл
GitHub
GitHub
родитель
e60f878090
Коммит
60a747f975
@@ -1406,16 +1406,18 @@ func TestGetPrepackagedPlaybooksPluginIn(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestInstallMarketplacePlugin(t *testing.T) {
|
||||
th := Setup(t).InitBasic()
|
||||
defer th.TearDown()
|
||||
path, _ := fileutils.FindDir("tests")
|
||||
|
||||
th.App.UpdateConfig(func(cfg *model.Config) {
|
||||
th := SetupConfig(t, func(cfg *model.Config) {
|
||||
*cfg.PluginSettings.Enable = true
|
||||
*cfg.PluginSettings.EnableUploads = true
|
||||
*cfg.PluginSettings.EnableMarketplace = false
|
||||
})
|
||||
cfg.PluginSettings.SignaturePublicKeyFiles = []string{
|
||||
filepath.Join(path, "development-private-key.asc"),
|
||||
}
|
||||
}).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
path, _ := fileutils.FindDir("tests")
|
||||
signatureFilename := "testplugin2.tar.gz.sig"
|
||||
signatureFileReader, err := os.Open(filepath.Join(path, signatureFilename))
|
||||
require.NoError(t, err)
|
||||
@@ -1581,11 +1583,6 @@ func TestInstallMarketplacePlugin(t *testing.T) {
|
||||
*cfg.PluginSettings.MarketplaceURL = testServer.URL
|
||||
})
|
||||
|
||||
key, err := os.Open(filepath.Join(path, "development-private-key.asc"))
|
||||
require.NoError(t, err)
|
||||
appErr := th.App.AddPublicKey("pub_key", key)
|
||||
require.Nil(t, appErr)
|
||||
|
||||
pRequest := &model.InstallMarketplacePluginRequest{Id: "testplugin2"}
|
||||
manifest, _, err := client.InstallMarketplacePlugin(context.Background(), pRequest)
|
||||
require.NoError(t, err)
|
||||
@@ -1627,11 +1624,6 @@ func TestInstallMarketplacePlugin(t *testing.T) {
|
||||
*cfg.PluginSettings.MarketplaceURL = testServer.URL
|
||||
})
|
||||
|
||||
key, err := os.Open(filepath.Join(path, "development-private-key.asc"))
|
||||
require.NoError(t, err)
|
||||
appErr := th.App.AddPublicKey("pub_key", key)
|
||||
require.Nil(t, appErr)
|
||||
|
||||
pRequest := &model.InstallMarketplacePluginRequest{Id: "testplugin2", Version: "9.9.9"}
|
||||
manifest, _, err := client.InstallMarketplacePlugin(context.Background(), pRequest)
|
||||
require.NoError(t, err)
|
||||
@@ -1833,24 +1825,14 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
th := SetupConfig(t, func(cfg *model.Config) {
|
||||
// Disable auto-installing prepackaged plugins
|
||||
*cfg.PluginSettings.AutomaticPrepackagedPlugins = false
|
||||
cfg.PluginSettings.SignaturePublicKeyFiles = []string{
|
||||
filepath.Join(path, "development-private-key.asc"),
|
||||
}
|
||||
}).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
|
||||
pluginSignatureFile, err := os.Open(filepath.Join(path, "testplugin.tar.gz.asc"))
|
||||
require.NoError(t, err)
|
||||
pluginSignatureData, err := io.ReadAll(pluginSignatureFile)
|
||||
require.NoError(t, err)
|
||||
|
||||
key, err := os.Open(filepath.Join(path, "development-private-key.asc"))
|
||||
require.NoError(t, err)
|
||||
appErr := th.App.AddPublicKey("pub_key", key)
|
||||
require.Nil(t, appErr)
|
||||
|
||||
t.Cleanup(func() {
|
||||
appErr = th.App.DeletePublicKey("pub_key")
|
||||
require.Nil(t, appErr)
|
||||
})
|
||||
expectedSignaturePath := filepath.Join(prepackagedPluginsDir, "testplugin.tar.gz.sig")
|
||||
|
||||
testServer := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
|
||||
serverVersion := req.URL.Query().Get("server_version")
|
||||
@@ -1896,7 +1878,7 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
plugins := env.PrepackagedPlugins()
|
||||
require.Len(t, plugins, 1)
|
||||
require.Equal(t, "testplugin", plugins[0].Manifest.Id)
|
||||
require.Equal(t, pluginSignatureData, plugins[0].Signature)
|
||||
require.Equal(t, expectedSignaturePath, plugins[0].SignaturePath)
|
||||
|
||||
pluginsResp, _, err = client.GetPlugins(context.Background())
|
||||
require.NoError(t, err)
|
||||
@@ -1956,7 +1938,7 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
assert.Equal(t, "0.0.1", manifest.Version)
|
||||
})
|
||||
|
||||
t.Run("Install both a prepacked and a Marketplace plugin", func(t *testing.T) {
|
||||
t.Run("Install both a prepackaged and a Marketplace plugin", func(t *testing.T) {
|
||||
pRequest := &model.InstallMarketplacePluginRequest{Id: "testplugin"}
|
||||
manifest1, _, err := client.InstallMarketplacePlugin(context.Background(), pRequest)
|
||||
require.NoError(t, err)
|
||||
@@ -1993,9 +1975,6 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
},
|
||||
})
|
||||
})
|
||||
|
||||
appErr = th.App.DeletePublicKey("pub_key")
|
||||
require.Nil(t, appErr)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -2016,15 +1995,13 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
th := SetupConfig(t, func(cfg *model.Config) {
|
||||
// Disable auto-installing prepackaged plugins
|
||||
*cfg.PluginSettings.AutomaticPrepackagedPlugins = false
|
||||
cfg.PluginSettings.SignaturePublicKeyFiles = []string{
|
||||
filepath.Join(path, "development-private-key.asc"),
|
||||
}
|
||||
}).InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
|
||||
key, err := os.Open(filepath.Join(path, "development-private-key.asc"))
|
||||
require.NoError(t, err)
|
||||
appErr := th.App.AddPublicKey("pub_key", key)
|
||||
require.Nil(t, appErr)
|
||||
|
||||
testServer := httptest.NewServer(http.HandlerFunc(func(res http.ResponseWriter, req *http.Request) {
|
||||
serverVersion := req.URL.Query().Get("server_version")
|
||||
require.NotEmpty(t, serverVersion)
|
||||
@@ -2050,9 +2027,7 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
|
||||
env := th.App.GetPluginsEnvironment()
|
||||
plugins := env.PrepackagedPlugins()
|
||||
require.Len(t, plugins, 1)
|
||||
require.Equal(t, "testplugin", plugins[0].Manifest.Id)
|
||||
require.Empty(t, plugins[0].Signature)
|
||||
require.Len(t, plugins, 0)
|
||||
|
||||
pluginsResp, _, err := client.GetPlugins(context.Background())
|
||||
require.NoError(t, err)
|
||||
@@ -2080,10 +2055,6 @@ func TestInstallMarketplacePluginPrepackagedDisabled(t *testing.T) {
|
||||
require.NoError(t, err)
|
||||
require.Len(t, pluginsResp.Active, 0)
|
||||
require.Len(t, pluginsResp.Inactive, 0)
|
||||
|
||||
// Clean up
|
||||
appErr = th.App.DeletePublicKey("pub_key")
|
||||
require.Nil(t, appErr)
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
Ссылка в новой задаче
Block a user