{"action":"created","comment":{"url":"https://api.github.com/repos/xbmc/xbmc/pulls/comments/174708308","pull_request_review_id":104111262,"id":174708308,"diff_hunk":"@@ -55,6 +56,35 @@ using namespace KODI::MESSAGING;\n \n using KODI::MESSAGING::HELPERS::DialogResponse;\n \n+CRepository::ResolveResult CRepository::ResolvePathAndHash(const AddonPtr& addon) const\n+{\n+  CCurlFile file;\n+  CURL url{addon->Path()};\n+  // Do not follow mirror redirect, we want the headers of the redirect response\n+  url.SetProtocolOption(\"redirect-limit\", \"0\");\n+  if (!file.Open(url))\n+  {\n+    CLog::Log(LOGWARNING, \"Could not fetch addon location and hash from {}\", url.Get());\n+    return {};\n+  }\n+\n+  // Return the location from the header so we don't have to look it up again\n+  // (saves one request per addon install)\n+  std::string location = file.GetHttpHeader().GetValue(\"location\");","path":"xbmc/addons/Repository.cpp","position":26,"original_position":26,"commit_id":"c696a852c75438557d00622dde7812ba7eccfac6","original_commit_id":"c696a852c75438557d00622dde7812ba7eccfac6","user":{"login":"wsnipex","id":909455,"avatar_url":"https://avatars2.githubusercontent.com/u/909455?v=4","gravatar_id":"","url":"https://api.github.com/users/wsnipex","html_url":"https://github.com/wsnipex","followers_url":"https://api.github.com/users/wsnipex/followers","following_url":"https://api.github.com/users/wsnipex/following{/other_user}","gists_url":"https://api.github.com/users/wsnipex/gists{/gist_id}","starred_url":"https://api.github.com/users/wsnipex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsnipex/subscriptions","organizations_url":"https://api.github.com/users/wsnipex/orgs","repos_url":"https://api.github.com/users/wsnipex/repos","events_url":"https://api.github.com/users/wsnipex/events{/privacy}","received_events_url":"https://api.github.com/users/wsnipex/received_events","type":"User","site_admin":false},"body":"I'd be possible to get all headers of all requests (incl 30x) while directly following the redirect.\r\n","created_at":"2018-03-15T08:39:35Z","updated_at":"2018-03-15T08:39:35Z","html_url":"https://github.com/xbmc/xbmc/pull/13647#discussion_r174708308","pull_request_url":"https://api.github.com/repos/xbmc/xbmc/pulls/13647","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/xbmc/xbmc/pulls/comments/174708308"},"html":{"href":"https://github.com/xbmc/xbmc/pull/13647#discussion_r174708308"},"pull_request":{"href":"https://api.github.com/repos/xbmc/xbmc/pulls/13647"}},"in_reply_to_id":174706230},"pull_request":{"url":"https://api.github.com/repos/xbmc/xbmc/pulls/13647","id":174930598,"html_url":"https://github.com/xbmc/xbmc/pull/13647","diff_url":"https://github.com/xbmc/xbmc/pull/13647.diff","patch_url":"https://github.com/xbmc/xbmc/pull/13647.patch","issue_url":"https://api.github.com/repos/xbmc/xbmc/issues/13647","number":13647,"state":"open","locked":false,"title":"Verify add-on zip authenticity","user":{"login":"pkerling","id":4533697,"avatar_url":"https://avatars1.githubusercontent.com/u/4533697?v=4","gravatar_id":"","url":"https://api.github.com/users/pkerling","html_url":"https://github.com/pkerling","followers_url":"https://api.github.com/users/pkerling/followers","following_url":"https://api.github.com/users/pkerling/following{/other_user}","gists_url":"https://api.github.com/users/pkerling/gists{/gist_id}","starred_url":"https://api.github.com/users/pkerling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkerling/subscriptions","organizations_url":"https://api.github.com/users/pkerling/orgs","repos_url":"https://api.github.com/users/pkerling/repos","events_url":"https://api.github.com/users/pkerling/events{/privacy}","received_events_url":"https://api.github.com/users/pkerling/received_events","type":"User","site_admin":false},"body":"Enable SSL connections for add-on zip downloads from the official repository and verify the downloaded files with the hashes provided in the redirect\r\n\r\n(for the server side: cc @kib  @wsnipex)\r\n\r\nRationale\r\n---\r\nWe've long been discussing how to make the Kodi update mechanism more secure (or rather, not *completely* insecure) with things like TUF etc.\r\nTUF is unfortunately a very difficult path, so I would like to propose this as an interim \"solution\" for Leia.\r\n\r\nIt does not prevent all (or even most) of the bad things TUF would. But it at least doesn't make it so dead simple to own a Kodi installation via network and means we don't have to trust the mirrors as much as we do now.\r\nThe principle is: We get the hash and location of the zip file from the central mirror redirector run by ourselves (`mirrors.kodi.tv`). Since we do that over SSL, the hash cannot be tampered with. The redirector can then give us the URI of the file on a mirror of its choice, be it HTTP or HTTPS. Using SSL connections for all mirrors is not an option at the moment since many of those do not support it yet.\r\n\r\nThis is still WIP, but I want to get early feedback whether this is the direction we want to be going in first. The basic principle is implemented.\r\n\r\nProblems\r\n---\r\n* If we decide to do this, it implies that we cannot later remove the mirror redirect and the `Content-Sha256` header without breaking updates in older installations.\r\n* Third-party repositories do not directly benefit from this except when they duplicate our mirror setup. If they don't have too much traffic or can handle it, they should just use HTTPS. We might want to show a warning when a repository neither has this hash feature nor uses a SSL connection - or even make it unsupported?\r\n\r\nTODO\r\n---\r\n- [ ] Decide whether the old `.md5` code path should be kept (for 3rdparty repositories? does someone use it?)\r\n- [ ] Only enable the check when it is enabled for the repository\r\n- [ ] Fix base64 encoding in mirrorbits\r\n- [ ] Split `icondir` from `datadir` so Kodi doesn't use SSL connections for downloading the icons\r\n- [ ] Switch everything to sha256\r\n- [ ] Check whether we can secure `addons.xml` further and if it opens up any attack vectors\r\n","created_at":"2018-03-14T11:49:05Z","updated_at":"2018-03-15T08:39:35Z","closed_at":null,"merged_at":null,"merge_commit_sha":"202a252c59b3eacafb2e4e25057f9dde4c3ce0e4","assignee":{"login":"pkerling","id":4533697,"avatar_url":"https://avatars1.githubusercontent.com/u/4533697?v=4","gravatar_id":"","url":"https://api.github.com/users/pkerling","html_url":"https://github.com/pkerling","followers_url":"https://api.github.com/users/pkerling/followers","following_url":"https://api.github.com/users/pkerling/following{/other_user}","gists_url":"https://api.github.com/users/pkerling/gists{/gist_id}","starred_url":"https://api.github.com/users/pkerling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkerling/subscriptions","organizations_url":"https://api.github.com/users/pkerling/orgs","repos_url":"https://api.github.com/users/pkerling/repos","events_url":"https://api.github.com/users/pkerling/events{/privacy}","received_events_url":"https://api.github.com/users/pkerling/received_events","type":"User","site_admin":false},"assignees":[{"login":"pkerling","id":4533697,"avatar_url":"https://avatars1.githubusercontent.com/u/4533697?v=4","gravatar_id":"","url":"https://api.github.com/users/pkerling","html_url":"https://github.com/pkerling","followers_url":"https://api.github.com/users/pkerling/followers","following_url":"https://api.github.com/users/pkerling/following{/other_user}","gists_url":"https://api.github.com/users/pkerling/gists{/gist_id}","starred_url":"https://api.github.com/users/pkerling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkerling/subscriptions","organizations_url":"https://api.github.com/users/pkerling/orgs","repos_url":"https://api.github.com/users/pkerling/repos","events_url":"https://api.github.com/users/pkerling/events{/privacy}","received_events_url":"https://api.github.com/users/pkerling/received_events","type":"User","site_admin":false}],"requested_reviewers":[{"login":"jimfcarroll","id":372696,"avatar_url":"https://avatars2.githubusercontent.com/u/372696?v=4","gravatar_id":"","url":"https://api.github.com/users/jimfcarroll","html_url":"https://github.com/jimfcarroll","followers_url":"https://api.github.com/users/jimfcarroll/followers","following_url":"https://api.github.com/users/jimfcarroll/following{/other_user}","gists_url":"https://api.github.com/users/jimfcarroll/gists{/gist_id}","starred_url":"https://api.github.com/users/jimfcarroll/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimfcarroll/subscriptions","organizations_url":"https://api.github.com/users/jimfcarroll/orgs","repos_url":"https://api.github.com/users/jimfcarroll/repos","events_url":"https://api.github.com/users/jimfcarroll/events{/privacy}","received_events_url":"https://api.github.com/users/jimfcarroll/received_events","type":"User","site_admin":false},{"login":"notspiff","id":5844320,"avatar_url":"https://avatars1.githubusercontent.com/u/5844320?v=4","gravatar_id":"","url":"https://api.github.com/users/notspiff","html_url":"https://github.com/notspiff","followers_url":"https://api.github.com/users/notspiff/followers","following_url":"https://api.github.com/users/notspiff/following{/other_user}","gists_url":"https://api.github.com/users/notspiff/gists{/gist_id}","starred_url":"https://api.github.com/users/notspiff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/notspiff/subscriptions","organizations_url":"https://api.github.com/users/notspiff/orgs","repos_url":"https://api.github.com/users/notspiff/repos","events_url":"https://api.github.com/users/notspiff/events{/privacy}","received_events_url":"https://api.github.com/users/notspiff/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":276939482,"url":"https://api.github.com/repos/xbmc/xbmc/labels/Addons","name":"Addons","color":"009800","default":false},{"id":736775919,"url":"https://api.github.com/repos/xbmc/xbmc/labels/Don't%20merge","name":"Don't merge","color":"f235e8","default":false},{"id":1659142,"url":"https://api.github.com/repos/xbmc/xbmc/labels/Feature","name":"Feature","color":"0b02e1","default":false},{"id":620618099,"url":"https://api.github.com/repos/xbmc/xbmc/labels/No-Jenkins","name":"No-Jenkins","color":"d4c5f9","default":false},{"id":1859313,"url":"https://api.github.com/repos/xbmc/xbmc/labels/RFC","name":"RFC","color":"eb6420","default":false},{"id":400751192,"url":"https://api.github.com/repos/xbmc/xbmc/labels/v18%20Leia","name":"v18 Leia","color":"fbca04","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/xbmc/xbmc/pulls/13647/commits","review_comments_url":"https://api.github.com/repos/xbmc/xbmc/pulls/13647/comments","review_comment_url":"https://api.github.com/repos/xbmc/xbmc/pulls/comments{/number}","comments_url":"https://api.github.com/repos/xbmc/xbmc/issues/13647/comments","statuses_url":"https://api.github.com/repos/xbmc/xbmc/statuses/c696a852c75438557d00622dde7812ba7eccfac6","head":{"label":"pkerling:addon-ssl","ref":"addon-ssl","sha":"c696a852c75438557d00622dde7812ba7eccfac6","user":{"login":"pkerling","id":4533697,"avatar_url":"https://avatars1.githubusercontent.com/u/4533697?v=4","gravatar_id":"","url":"https://api.github.com/users/pkerling","html_url":"https://github.com/pkerling","followers_url":"https://api.github.com/users/pkerling/followers","following_url":"https://api.github.com/users/pkerling/following{/other_user}","gists_url":"https://api.github.com/users/pkerling/gists{/gist_id}","starred_url":"https://api.github.com/users/pkerling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkerling/subscriptions","organizations_url":"https://api.github.com/users/pkerling/orgs","repos_url":"https://api.github.com/users/pkerling/repos","events_url":"https://api.github.com/users/pkerling/events{/privacy}","received_events_url":"https://api.github.com/users/pkerling/received_events","type":"User","site_admin":false},"repo":{"id":90943451,"name":"xbmc","full_name":"pkerling/xbmc","owner":{"login":"pkerling","id":4533697,"avatar_url":"https://avatars1.githubusercontent.com/u/4533697?v=4","gravatar_id":"","url":"https://api.github.com/users/pkerling","html_url":"https://github.com/pkerling","followers_url":"https://api.github.com/users/pkerling/followers","following_url":"https://api.github.com/users/pkerling/following{/other_user}","gists_url":"https://api.github.com/users/pkerling/gists{/gist_id}","starred_url":"https://api.github.com/users/pkerling/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkerling/subscriptions","organizations_url":"https://api.github.com/users/pkerling/orgs","repos_url":"https://api.github.com/users/pkerling/repos","events_url":"https://api.github.com/users/pkerling/events{/privacy}","received_events_url":"https://api.github.com/users/pkerling/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/pkerling/xbmc","description":"Kodi fork for GSoC 2017: Wayland Support","fork":true,"url":"https://api.github.com/repos/pkerling/xbmc","forks_url":"https://api.github.com/repos/pkerling/xbmc/forks","keys_url":"https://api.github.com/repos/pkerling/xbmc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/pkerling/xbmc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/pkerling/xbmc/teams","hooks_url":"https://api.github.com/repos/pkerling/xbmc/hooks","issue_events_url":"https://api.github.com/repos/pkerling/xbmc/issues/events{/number}","events_url":"https://api.github.com/repos/pkerling/xbmc/events","assignees_url":"https://api.github.com/repos/pkerling/xbmc/assignees{/user}","branches_url":"https://api.github.com/repos/pkerling/xbmc/branches{/branch}","tags_url":"https://api.github.com/repos/pkerling/xbmc/tags","blobs_url":"https://api.github.com/repos/pkerling/xbmc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/pkerling/xbmc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/pkerling/xbmc/git/refs{/sha}","trees_url":"https://api.github.com/repos/pkerling/xbmc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/pkerling/xbmc/statuses/{sha}","languages_url":"https://api.github.com/repos/pkerling/xbmc/languages","stargazers_url":"https://api.github.com/repos/pkerling/xbmc/stargazers","contributors_url":"https://api.github.com/repos/pkerling/xbmc/contributors","subscribers_url":"https://api.github.com/repos/pkerling/xbmc/subscribers","subscription_url":"https://api.github.com/repos/pkerling/xbmc/subscription","commits_url":"https://api.github.com/repos/pkerling/xbmc/commits{/sha}","git_commits_url":"https://api.github.com/repos/pkerling/xbmc/git/commits{/sha}","comments_url":"https://api.github.com/repos/pkerling/xbmc/comments{/number}","issue_comment_url":"https://api.github.com/repos/pkerling/xbmc/issues/comments{/number}","contents_url":"https://api.github.com/repos/pkerling/xbmc/contents/{+path}","compare_url":"https://api.github.com/repos/pkerling/xbmc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/pkerling/xbmc/merges","archive_url":"https://api.github.com/repos/pkerling/xbmc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/pkerling/xbmc/downloads","issues_url":"https://api.github.com/repos/pkerling/xbmc/issues{/number}","pulls_url":"https://api.github.com/repos/pkerling/xbmc/pulls{/number}","milestones_url":"https://api.github.com/repos/pkerling/xbmc/milestones{/number}","notifications_url":"https://api.github.com/repos/pkerling/xbmc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/pkerling/xbmc/labels{/name}","releases_url":"https://api.github.com/repos/pkerling/xbmc/releases{/id}","deployments_url":"https://api.github.com/repos/pkerling/xbmc/deployments","created_at":"2017-05-11T06:05:15Z","updated_at":"2017-08-27T17:17:22Z","pushed_at":"2018-03-15T07:32:03Z","git_url":"git://github.com/pkerling/xbmc.git","ssh_url":"git@github.com:pkerling/xbmc.git","clone_url":"https://github.com/pkerling/xbmc.git","svn_url":"https://github.com/pkerling/xbmc","homepage":"","size":622317,"stargazers_count":6,"watchers_count":6,"language":"C++","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":4,"license":null,"forks":1,"open_issues":4,"watchers":6,"default_branch":"master"}},"base":{"label":"xbmc:master","ref":"master","sha":"004ad26cac6f8fdee84f5e2435584b66d36bf40b","user":{"login":"xbmc","id":199122,"avatar_url":"https://avatars2.githubusercontent.com/u/199122?v=4","gravatar_id":"","url":"https://api.github.com/users/xbmc","html_url":"https://github.com/xbmc","followers_url":"https://api.github.com/users/xbmc/followers","following_url":"https://api.github.com/users/xbmc/following{/other_user}","gists_url":"https://api.github.com/users/xbmc/gists{/gist_id}","starred_url":"https://api.github.com/users/xbmc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xbmc/subscriptions","organizations_url":"https://api.github.com/users/xbmc/orgs","repos_url":"https://api.github.com/users/xbmc/repos","events_url":"https://api.github.com/users/xbmc/events{/privacy}","received_events_url":"https://api.github.com/users/xbmc/received_events","type":"Organization","site_admin":false},"repo":{"id":1217614,"name":"xbmc","full_name":"xbmc/xbmc","owner":{"login":"xbmc","id":199122,"avatar_url":"https://avatars2.githubusercontent.com/u/199122?v=4","gravatar_id":"","url":"https://api.github.com/users/xbmc","html_url":"https://github.com/xbmc","followers_url":"https://api.github.com/users/xbmc/followers","following_url":"https://api.github.com/users/xbmc/following{/other_user}","gists_url":"https://api.github.com/users/xbmc/gists{/gist_id}","starred_url":"https://api.github.com/users/xbmc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xbmc/subscriptions","organizations_url":"https://api.github.com/users/xbmc/orgs","repos_url":"https://api.github.com/users/xbmc/repos","events_url":"https://api.github.com/users/xbmc/events{/privacy}","received_events_url":"https://api.github.com/users/xbmc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/xbmc/xbmc","description":"Kodi Main Repository - By using this code you agree with our policy and will follow the GPLv2 license as included","fork":false,"url":"https://api.github.com/repos/xbmc/xbmc","forks_url":"https://api.github.com/repos/xbmc/xbmc/forks","keys_url":"https://api.github.com/repos/xbmc/xbmc/keys{/key_id}","collaborators_url":"https://api.github.com/repos/xbmc/xbmc/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/xbmc/xbmc/teams","hooks_url":"https://api.github.com/repos/xbmc/xbmc/hooks","issue_events_url":"https://api.github.com/repos/xbmc/xbmc/issues/events{/number}","events_url":"https://api.github.com/repos/xbmc/xbmc/events","assignees_url":"https://api.github.com/repos/xbmc/xbmc/assignees{/user}","branches_url":"https://api.github.com/repos/xbmc/xbmc/branches{/branch}","tags_url":"https://api.github.com/repos/xbmc/xbmc/tags","blobs_url":"https://api.github.com/repos/xbmc/xbmc/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/xbmc/xbmc/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/xbmc/xbmc/git/refs{/sha}","trees_url":"https://api.github.com/repos/xbmc/xbmc/git/trees{/sha}","statuses_url":"https://api.github.com/repos/xbmc/xbmc/statuses/{sha}","languages_url":"https://api.github.com/repos/xbmc/xbmc/languages","stargazers_url":"https://api.github.com/repos/xbmc/xbmc/stargazers","contributors_url":"https://api.github.com/repos/xbmc/xbmc/contributors","subscribers_url":"https://api.github.com/repos/xbmc/xbmc/subscribers","subscription_url":"https://api.github.com/repos/xbmc/xbmc/subscription","commits_url":"https://api.github.com/repos/xbmc/xbmc/commits{/sha}","git_commits_url":"https://api.github.com/repos/xbmc/xbmc/git/commits{/sha}","comments_url":"https://api.github.com/repos/xbmc/xbmc/comments{/number}","issue_comment_url":"https://api.github.com/repos/xbmc/xbmc/issues/comments{/number}","contents_url":"https://api.github.com/repos/xbmc/xbmc/contents/{+path}","compare_url":"https://api.github.com/repos/xbmc/xbmc/compare/{base}...{head}","merges_url":"https://api.github.com/repos/xbmc/xbmc/merges","archive_url":"https://api.github.com/repos/xbmc/xbmc/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/xbmc/xbmc/downloads","issues_url":"https://api.github.com/repos/xbmc/xbmc/issues{/number}","pulls_url":"https://api.github.com/repos/xbmc/xbmc/pulls{/number}","milestones_url":"https://api.github.com/repos/xbmc/xbmc/milestones{/number}","notifications_url":"https://api.github.com/repos/xbmc/xbmc/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/xbmc/xbmc/labels{/name}","releases_url":"https://api.github.com/repos/xbmc/xbmc/releases{/id}","deployments_url":"https://api.github.com/repos/xbmc/xbmc/deployments","created_at":"2011-01-03T21:18:51Z","updated_at":"2018-03-15T02:16:38Z","pushed_at":"2018-03-15T08:36:33Z","git_url":"git://github.com/xbmc/xbmc.git","ssh_url":"git@github.com:xbmc/xbmc.git","clone_url":"https://github.com/xbmc/xbmc.git","svn_url":"https://github.com/xbmc/xbmc","homepage":"http://kodi.wiki/view/Official:Trademark_Policy","size":1444388,"stargazers_count":6833,"watchers_count":6833,"language":"C++","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":4543,"mirror_url":null,"archived":false,"open_issues_count":147,"license":{"key":"gpl-2.0","name":"GNU General Public License v2.0","spdx_id":"GPL-2.0","url":"https://api.github.com/licenses/gpl-2.0"},"forks":4543,"open_issues":147,"watchers":6833,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/xbmc/xbmc/pulls/13647"},"html":{"href":"https://github.com/xbmc/xbmc/pull/13647"},"issue":{"href":"https://api.github.com/repos/xbmc/xbmc/issues/13647"},"comments":{"href":"https://api.github.com/repos/xbmc/xbmc/issues/13647/comments"},"review_comments":{"href":"https://api.github.com/repos/xbmc/xbmc/pulls/13647/comments"},"review_comment":{"href":"https://api.github.com/repos/xbmc/xbmc/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/xbmc/xbmc/pulls/13647/commits"},"statuses":{"href":"https://api.github.com/repos/xbmc/xbmc/statuses/c696a852c75438557d00622dde7812ba7eccfac6"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"wsnipex"}}