Skip to content

Implemented package_index.json signature verification #791

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jul 7, 2020
Merged

Implemented package_index.json signature verification #791

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
bf2cb5c
Added download of signature files for 'downloads.arduino.cc' domain
cmaglie Jul 6, 2020
b9a1a78
Slightly simplified tmp file creation
cmaglie Jul 6, 2020
39dab6a
Use patched version of rice-box
cmaglie Jul 6, 2020
834f538
Added signature verification subroutines
cmaglie Jul 6, 2020
ea2072d
Implemented package_index.json signature verification
cmaglie Jul 6, 2020
320e93b
Added missing license headers
cmaglie Jul 6, 2020
b5c7f94
Added negative test on signature check
cmaglie Jul 6, 2020
18ac3db
Only copy signature if the file is present
cmaglie Jul 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Added missing license headers
  • Loading branch information
@cmaglie
cmaglie committed Jul 6, 2020
commit 320e93bfe4245ab52858e790361ed433ac3c5f6d
15 changes: 15 additions & 0 deletions arduino/security/signature_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,18 @@
// This file is part of arduino-cli.
//
// Copyright 2020 ARDUINO SA (http://www.arduino.cc/)
//
// This software is released under the GNU General Public License version 3,
// which covers the main part of arduino-cli.
// The terms of this license can be found at:
// https://www.gnu.org/licenses/gpl-3.0.en.html
//
// You can be released from the requirements of the above licenses by purchasing
// a commercial license. Buying such a license is mandatory if you want to
// modify or otherwise use the software for commercial activities involving the
// Arduino software without disclosing the source code of your own applications.
// To purchase a commercial license, send an email to license@arduino.cc.

package security

import (
Expand Down