Repository navigation
Harden the token store, macOS signing, the release integrity check and the MSI check - #216
Merged
Merged
Conversation
The integrity check derived the files to authenticate from the bundles attached to the release, so removing a bundle together with replacing its file went unnoticed as long as one bundle remained. The required set is now SHA256SUMS, every file it lists and every attached archive or installer, whichever bundles are present; a missing bundle is reported. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
The signing steps accepted any Developer ID certificate with a TeamIdentifier, and never read the installer certificate's team. The expected Team ID is now a constant in the workflows, compared exactly with the binary's TeamIdentifier and the installer certificate's Team ID. An empty or malformed value fails the first step. The constant is empty until a maintainer sets it. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
The administrative extraction of the MSI runs AdminExecuteSequence, so standard actions such as SelfRegModules could load a DLL shipped under the name of a payload file. The check now also refuses the tables that make such actions load payload code, requires every action of the administrative sequences to be a passive standard action, and compares LICENSE, NOTICE and USER-INFORMATION.md with the repository's copies by SHA-256. The signing job now checks out the commit for that comparison. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
The MSI check now reads _Tables once and refuses any table the package does not use, reads every row without swallowing errors, allows only the standard actions seen in each sequence (as a subset) and pins the Registry and Environment rows to the InstallDir value and the PATH entry. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
Mode bits do not cover NFSv4-style ACLs, which a parent folder can pass on to the sessions directory and the token file. On macOS the CLI now removes any ACL from the directory and the temporary file it creates, before a token is written, and refuses an existing directory or file that has one. On Linux a POSIX ACL is limited by the mask that chmod 600 sets, so nothing changes there. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
It was committed by accident; __pycache__/ is now ignored. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
…-0383 rustls-webpki 0.103.16 rejects certificate paths through the distrusted intermediates, and webpki-root-certs 1.0.10 drops the root that issued them. Signed-off-by: d0ubl3g <48954024+d0ubl3g@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardening from a security scan of the release and sign-in code.
chmod 600sets the POSIX ACL mask to no access, so no change is needed there.MACOS_TEAM_IDinrelease.ymlandmacos-signing-check.yml). It is compared exactly with the binary's TeamIdentifier and the installer certificate. The value is empty for now, so macOS signing fails closed until it is set.msiexec /aruns the package's administrative sequence. The check now:__pycache__/.