Enforce signature check on library_index.json (arduino#2326)

umbynos · Sep 20, 2023 · 28fc9d6 · 28fc9d6
1 parent 29c70df
commit 28fc9d6
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 3 deletions.
diff --git a/arduino/resources/index.go b/arduino/resources/index.go
@@ -17,6 +17,7 @@ package resources
 
 import (
 	"context"
+	"errors"
 	"net/url"
 	"path"
 	"strings"
@@ -33,8 +34,9 @@ import (
 
 // IndexResource is a reference to an index file URL with an optional signature.
 type IndexResource struct {
-	URL          *url.URL
-	SignatureURL *url.URL
+	URL                          *url.URL
+	SignatureURL                 *url.URL
+	EnforceSignatureVerification bool
 }
 
 // IndexFileName returns the index file name as it is saved in data dir (package_xxx_index.json).
@@ -140,6 +142,10 @@ func (res *IndexResource) Download(destDir *paths.Path, downloadCB rpc.DownloadP
 		} else if !valid {
 			return &arduino.SignatureVerificationFailedError{File: res.URL.String()}
 		}
+	} else {
+		if res.EnforceSignatureVerification {
+			return &arduino.PermissionDeniedError{Message: tr("Error verifying signature"), Cause: errors.New(tr("missing signature"))}
+		}
 	}
 
 	// TODO: Implement a ResourceValidator

diff --git a/commands/instances.go b/commands/instances.go
@@ -511,7 +511,8 @@ func UpdateLibrariesIndex(ctx context.Context, req *rpc.UpdateLibrariesIndexRequ
 	defer tmp.RemoveAll()
 
 	indexResource := resources.IndexResource{
-		URL: librariesmanager.LibraryIndexWithSignatureArchiveURL,
+		URL:                          librariesmanager.LibraryIndexWithSignatureArchiveURL,
+		EnforceSignatureVerification: true,
 	}
 	if err := indexResource.Download(lm.IndexFile.Parent(), downloadCB); err != nil {
 		return err