MM-16368 - Plugin Signing (#13017)

* [MM-18757] POST handler for `/plugins/marketplace` (#12372)

* Implement installMarketplacePlugin

* Add InstallMarketplacePlugin endpoint

* Fix go.mod

* merge with master

* Fix go.mod

* Fix plugin tests

* Move get plugin to marketplace client

* Fix stylistic concerns

* Add trailing newline to the go.mod

* [MM-16586] Add plugin signature settings (#12390)

* MM-17149 - Extend config.json for marketplace settings (#11933)

* MM-17149 - Extend config.json for marketplace settings

* Renamed MarketplaceUrl, tracking default marketplace url

* Added EnableMarketplace to the client config

* Revert "Added EnableMarketplace to the client config"

This reverts commit 0f982c4c661c2cd9bb96264e9a01a2363c40d9c5.

* MM-17149 - Added EnableMarketplace to the client config (#11958)

* Added EnableMarketplace to the client config

* Moved EnableMarketplace setting out of limited client configuration

* Add public key settings to the config.json

* Rename PublicKeys to SignaturePublicKeyFiles

* Change filepath.Split to Base

* Remove additional prints

* Force extention of a public key file

* Remove config validation

* Remove error on delete

* Remove config cloning

* Add error messages

* Add plugin public key tests

* Rename extension to PluginSignaturePublicKeyFileExtention

* Remove EnforceVerification

* Change []*PublicKeyDescription to []string

* Change .asc extension to .plugin.asc

* Change ordering of public methods

* Change plugin key commands

* Update examples in the plugin key commands

* Remove forcing extention

* Add verify signature in settings

* Fix tabbing

* Fix naming

* Remove unused text

* Remove unused text

* Update command examples

* Fix unit tests

* Change errors.New to errors.Wrap

* Fix verbose flag

* Change .asc to .gpg

* Fix }

* Change AddPublicKey signature

* Change public.key extension

* Add plugin public key command tests

* Update en.json

* Bootstrap the public keys

* Update en.json

* Fix en.json

* Fix en.json

* Bootstrap hard-coded public key

* Remove unused texts in en.json

* Change file to name

* Add license header

* Update development public key

* Remove writeFile method

* Remove .plugin.asc extension

* Rename publiKey to mattermostPublicKey

* Remove init_public_keys string

* GolangCI

* Closing file handlers

* Fixed test that was installing nps plugin

* [MM-19798] Implement plugin signature verification (#12768)

* MM-17149 - Extend config.json for marketplace settings (#11933)

* MM-17149 - Extend config.json for marketplace settings

* Renamed MarketplaceUrl, tracking default marketplace url

* Added EnableMarketplace to the client config

* Revert "Added EnableMarketplace to the client config"

This reverts commit 0f982c4c661c2cd9bb96264e9a01a2363c40d9c5.

* MM-17149 - Added EnableMarketplace to the client config (#11958)

* Added EnableMarketplace to the client config

* Moved EnableMarketplace setting out of limited client configuration

* Add public key settings to the config.json

* Rename PublicKeys to SignaturePublicKeyFiles

* Change filepath.Split to Base

* Remove additional prints

* Force extention of a public key file

* Remove config validation

* Remove error on delete

* Remove config cloning

* Add error messages

* Add plugin public key tests

* Rename extension to PluginSignaturePublicKeyFileExtention

* Remove EnforceVerification

* Change []*PublicKeyDescription to []string

* Change .asc extension to .plugin.asc

* Change ordering of public methods

* Change plugin key commands

* Update examples in the plugin key commands

* Remove forcing extention

* Add verify signature in settings

* Fix tabbing

* Fix naming

* Remove unused text

* Remove unused text

* Update command examples

* Fix unit tests

* Change errors.New to errors.Wrap

* Fix verbose flag

* Change .asc to .gpg

* Fix }

* Change AddPublicKey signature

* Change public.key extension

* Add plugin public key command tests

* Update en.json

* Bootstrap the public keys

* Update en.json

* Fix en.json

* Fix en.json

* Bootstrap hard-coded public key

* Remove unused texts in en.json

* Change file to name

* Add license header

* Implement plugin signature verification

* Remove benburker openpgp

* Update en.json

* Update development public key

* Add support of multiple signatures in filestore

* Update en.json

* Run go mod vendor

* Fix style

* Remove writeFile method

* Remove .plugin.asc extension

* Rename publiKey to mattermostPublicKey

* Verify plugin with mattermost public key

* Remove init_public_keys string

* Add InstallPluginWithSignature method and  Refactor

* Add signature verification on claster notification

* Remove armored signature headers

* Add error strings

* Fix en.json

* Change signatureStorePath

* Implement minor fixes

* Refactor plugin install methods

* Add installPlugin method to uploadPlugin

* Update en.json

* Refactor installPlugin

* Limit number of signatures

* Close signatures

* Fix helper function

* Fix fromReadCloseSeekerToReadSeeker

* Cleaned up ReadCloseSeeker for signatures

* Remove signature truncation on FS

* GolangCI

* Add tests for armored signatures and plugin uploads

* Fix nil slice issue

* Fix TestPluginSync

* Fixed tests

* Return io.ReadSeeker from downloadFromUrl

* Add log for the found plugins in the file store

* Remove logging plugin detection info

* [MM-20134] Consume and store single-signature for each plugin (#13081)

* Consume and store single-signature for each plugin

* Fix en.json

* Remove saveSignature method

* Remove public key hash

* PR Feedback

* refactored config

* PR feedback

tests/development-public-key.asc

@@ -0,0 +1,41 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBF2gen8BDADKQObdPa6PagvYYMHNGIswCU9mVjOxr5g6niGQ/AxMW7AaHpkk
+16/oAzJ+DSyJRRgJMlFbN0iKBrZ6pi1pO5eS4l1CWW3eATr+32gW40SuS/sgzVrS
+OYPocqtsC9XWHK2j/UFbaI7aivnUYKIuBzhAWdcUYggjd1qgmM18zWYkuV1Jnywu
+Xue3Vsc/pLGqybG/EkBmZHRktr4fNn2xEjmKnUKp28vMF4Pz5e8/2qklSsc9UVl5
+avkex+glOeJSWF3L7S5CmHAWVgQNwKoJrvq7pKOUsZqrHScjyujeKp1Y6cUZdcBF
+8bsF1I+J2RxQFqcC6O08x29948P8UkOv4/FpUGYhx6tcqnQ0PdT4fjPslRapvdZo
+RiGdlvJLKUvhfRF0cgPxflde7M42cV5saOXKyaF2hPJi/SsFkTVSnyCyixdr8z+M
+QMIcgtrQ26ig9s5J0h2j3y9sgvvTh1nxE/XWOlrXjCVohNSRWZBjX1PEd2dAk4ZK
+OEB5YcST61kbhd0AEQEAAbRBTWF0dGVybW9zdCBJbmMuIChQbHVnaW4gc2lnbmlu
+ZyBSU0EgZGV2LWtleSkgPGFsaUBtYXR0ZXJtb3N0LmNvbT6JAc4EEwEIADgWIQTz
++s5F4N5kLIvWqOZMfGViwZLMHwUCXaB6fwIbAwULCQgHAgYVCgkICwIEFgIDAQIe
+AQIXgAAKCRBMfGViwZLMH/NoC/0UAvpTvT1sBD6qFpUOPZUmUSLLndtLzuYoMqID
+0vvTdxb1PdbQpVX2sMuS19upyAmkVRh50uxGcsOLU/lUaF8C1C22zeGvtdkbw+79
+Gv1AYlyCCEanhQSdH4z/t8W8nBcSw8kA+423guSzlIrrRSPCIyHSTP/MlwituN1+
+wEUlXMXnjY4nNpyik+e9LoKK05zCy1mYswAnx1I5IH44iOfjqjz2FGv3iFhuc5rt
+cEC26RyYCNVH7mIcCwd25/Np+IQbftfUVEugr1OGsSvdbAA3qWRtC9Q7VcFXy3A8
+1svxkGPiZw60oxkG9V5v1l/ETCWztzvZvXXXZcWNaDb81rpn2LFeFulJKBxLLonC
+gR/8l1hJAt8uS8ymOQRpVK9QVztlyxtZWZ7FxsfsC4AXthU3VFZjLUd1Tf4k5eW2
+ov9JPjcSHHBQp6ScjtSgLTb4s2B5mD7VFBhuFOTWs1mbpVaRVIpguvYKIdxtDfek
+0bjPQSI62K9G8mKGE4SqibfXhhO5AY0EXaB6fwEMALrPejAgOh7IWxmWJPO++8Fv
+8eJD5nU7I3I4cWgJolXDSP4gEpkwlfHzAn7BJwTKTvZ5oDqpQCQV3mwqumQlRBKS
+DHXU3b1Z4MOq3SbQlFfNduTCzKa7a79/DFf96TXilpVW/XT3HdN69810oCfo87Ub
+/fx2G6h9JLaxdwJ57b/8Ej4eNbclGgE4GYHP9Xf0FX7F2xIqaIm/RCTGf7uGlaU0
+RmeEFmy69T7jUAGI7g1gN1eldQ0F1q2HPuhP4iP39ZAz9K4Oyzl+B2IcHXyH2MjP
+WXfgjVi87O5rEUvA/cpYU5WFc8hflP7cil16rb/PiALzEx+GCpdARxvtMT/IbK/3
+luC2l/uw2ZYwtaL+8e9vyDOkVaWTD408Q51qrIANWwwLUSn71TuImGxCDzeuN79V
+/T5PSjR5o/s6lR0CGzNL/B3MziuD2Vr5Wl1LYkJfTlgmGrnm6aJ/zKbrOMnkeAu5
+Q0VgVOyibKhTu31WdXJ/jbhPQ5yd4UkduSAODStsRQARAQABiQG2BBgBCAAgFiEE
+8/rOReDeZCyL1qjmTHxlYsGSzB8FAl2gen8CGwwACgkQTHxlYsGSzB8v7Av+IC9I
+t7U3W51hCXH2wNcaSi8hxSYpFMl7GMX9zSKE8nKDmKBXUV7RJtU3cpGiGvgl+LLw
+qBtjahRP+PU8AQSLL/4W97ldQrrdnOET6mtEiJylliA187SkimSixyy31YnUKDn6
+PIeapJaoJ+JI22VhqbGd5tJCDbjTRFyiJP0L6vCEUAoLhpaqsqUiUw86//USl3uh
+P+G9m2z3QPmxVFP/xZFEbihprpe/AccDLFjTwEWAMag6vV0NoI0E+JGeICKtzkxB
+Pgi71N/jHKULPVMPXkaD30GT4k72lmuwqfvLz9uEhgSeAHakma8wUlp0aSw+kk4a
+dZmqpBXcl6VFSDpCJXANUS4IUqjVqnK4nAGONR4JFaoejtAnmlz61EtjWuzPYjQS
+0dL1Jv69WXLal7tzTJOZLekHas8DxzMgkID4IXCaSjwDb34mVgdaWyD1E302U3eX
+IfS6J8Zp6Bs1baubHXFifXU6SV805b6i46/1m99OPsVH85zCUHvu4asaiLcR
+=qIjw
+-----END PGP PUBLIC KEY BLOCK-----

tests/test-public-key.plugin.gpg

@@ -0,0 +1,42 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+23weBF1kMz0BDACoQ4hnmfz/KPQOx/J7fWj8DO/3HxAG+Y4rjvmGkNsaK02aNL7r
+AQMAX0X5aRGB880Gm/n3lZSOp2wyjb5N4MnzOI/M3lww+rnJzt0i21GwOqS/HDz0
+ZlAcO+nYecD5rkhHRUFeOnBzGKmV267VTwCTOjUcjdsuy2jLIZBk7xBV41n9gKZo
+rwzYnOFLw5suEN8sCPYxgFe5iuRj8wEHzW0JiMWUb8PMm1eWkR3ux0G9wRpQCAdh
+rB+RlKjG0UdfC3RhPR3fC0vqQkFj0tjM2G1xL3pLZIgygtZAsDAjPbeNzBBagzEv
+WzqJiK8qHoKGxujyXfQIRWDrnfdbgwsscKZHOpse5PMDRTIGroq0DG/5JaBaEkEb
+FwcvOe7CCOdPShZGMSFFncoblts4P+NgmwZHJH/sb3cbgivnSQT/SdnlYRI2vD9W
+CI345hjk/2ynF68uat+NxPtWPjPk/MOnHz170iPOF5Zp0glKV6RUV+Lj2U8HdEVM
+huHvQao59Shuas0AEQEAAbRSSmVzc2UgSGFsbGFtIChQbHVnaW4gTWFya2V0cGxh
+Y2UgU2lnbmluZyBLZXkgLSBEZXZlbG9wbWVudCkgPGplc3NlQG1hdHRlcm1vc3Qu
+Y29tPokB1AQTAQgAPhYhBLZ9dC4GijhaT2pBUp7t0EEt1PgpBQJdZDM9AhsDBQkA
+J40ABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEJ7t0EEt1Pgp3ikMAId6Syf8
+qb5QyU4/KS5myEbz6buP423Rgs9My6R7IkwPheQDf4ZF5W2rIlrV2bVf3VFvTfuT
+PXDInfBxr6sQtItP65+ct34C9GtG7xost+RzM5ArjsY1jRH276tJMQzfNeXXvtY3
+Fcahz5Wa1DBUAgUbArV9yzMprxMgNFLsVCYCl3/1iO3aXf1nw2GVJ+0nJ6YhGv3E
+Q1WHo0bkv2w64EzsnsBoKZCCuE/MK4k3MxDDWiva+OfuWnooV6QTBRm6C8wOIKXs
+tnAE8nvciKobD7VcZW09F+p/Jg1NbroyCaGDROiLtwUenEpyUx4zeYvAvFGTQz5c
+5zYGoZENzdG7UH7PiT7QlLqQx4rWpJH08D8ciDKeRyR+wiocP0/hh7UT+Wg0qnTV
+F7b6e5YORjLOjZKtp8nfFB9/Ql0L+7wzQzGz7NSojGWR1XdpGDpZTFts1WR6r4dc
+qjww52FBwjFdBNsaWJAsdJGzD2YT9GvzJZMUcSTlus8kAySKM+UVV6ZZSbkBjQRd
+ZDM9AQwAosl4FEbSDetXUf3dUJMqQipQAyhN7dJd3Gv4gfgW16ymzcV0jh/F6LJP
+JN+iRYziBvDmLDuBXaasdJvtemp2xljvI2x9+JFSFf8ZCqvKerwYNWb1icdzjzof
+Ki32PJxn8o/iJGV5xkhqw+PNOEE12RBgOLwLVAQP3FxS8mgzCM+cJKmIWYeVSoy2
+J3fDyZWyzQ5zBsvK/HtSW1R3MfhoRJq7E1VFVzrzmQvTSG3J+5LpwT0snMX7qona
+Rm7OovP3PsvlY2BB7+CLj7N6G3BQRTpfJndfea+4DfQlVYw0mEUlT77DXitfX701
+veVZu9cRg8PLaoHSRbU2BreDZRVPMq93svLxT7MCCBrau6wVOZQ5kqObDImSbxP6
+mNB+hi2HurNcB+LhwgVboC75q0CzdnaPqu2c2YlsvsaZWkK2jlvNyqlN9uoJ1bUp
+56hBWUOYAHx3hsZdEb4In95sP7cZAtKQJU0Q64UR/OPlU/a5fK591RLVlNY6LESX
+aZLsFMMbABEBAAGJAbwEGAEIACYWIQS2fXQuBoo4Wk9qQVKe7dBBLdT4KQUCXWQz
+PQIbDAUJACeNAAAKCRCe7dBBLdT4KelxC/9ze8cmYoLK2tr2cArX3Xw41wiXi4hV
+dMMSy8Y8ZUCFNBDIf1do3j6XMQ8EJROF2IBMnQFej7K4IJAQ/0rWFuE3rBS6g+n1
+7wiFMfj24RTHy/i303DWuveV7vbJw2oBYVY892hQAKxWpN/On4bctkHLxAYUpDu0
+EmtWkbsjet01tvZKRA6ONQcd/bzrkTVmJS4a5u3nIkaj2xx5YQGLrCY+ovDRc3Vg
+YSsIjJj5oOX52JabkE+XTi+g4wlAwIlMH1AB4qTS0HkHyLnLaNyjlNMwdiVQbiEC
+IwZrV+YU1byphlmbB8N08aIAXTNRkyqYgDiDY0aicPRxex3BRXBjYpD01hYkhnsZ
+HxZekApznHlf3C4a5SztKe1uR/A1GHRYMYuXUKc859SMIf69E/Vhr0T5m46R501h
+SQgCdRZmsX5Qo3JmjEFyVM1KfjxdsBt8O1uZOEgBuHEMMFRrsDhBPr6B/cPwoT5G
+gdlxUIdsQJ/ReVe1OOrgASKbG3qApwert2g=
+=FQgT
+-----END PGP PUBLIC KEY BLOCK-----

tests/testplugin.tar.gz.asc

@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEE8/rOReDeZCyL1qjmTHxlYsGSzB8FAl26+QIACgkQTHxlYsGS
+zB9SFwwAmexJelfpTRjnABJKWnFKuGOTNosVNOWqE+k//n1PV3H3uCzsluh/GWIb
+p5Nk6+UJieNvyAaQhIT5+3Rv0HkYvz4N15813SvQ8KOL8vE7oRFHttsZHpDKTpk1
+fQrd9JISMdViVj4x8VltgYkUIJDmULPfF9/m1OGV/BsWuHmmaEp3yw+KLdhL1j3U
+LlfW453nHvXrGT2rO3l+KDIVMt4zG6LVmL1C29yWtBplKxjgXKg/EbPcI31/8D9X
+QoIz9fUIFzqt4L1IfJhL6NlUiDc1iSKf4STiU2CzmHdKqRD9FdwgzZlG5P/xxCgu
+BVNy/c9musZbK9LtapncC/S62uwZzH5naTrCDs4F1VE2P5gjU9iv3AXVaeT4hLuI
+EbluXzmAt9hjox2s0O0X6EgW68FbUVX9bvu1tY9sUvWlXNCL2hrybF3YS3cZ2wGx
+rmdWmwktXDpJ8iN/b1+quw0CVC7myAefPK0U8356tktZHwcQEp2fmrF4PqX2qfJf
+cDzhj2yg
+=J9kV
+-----END PGP SIGNATURE-----