{"action":"created","issue":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/19792","repository_url":"https://api.github.com/repos/joomla/joomla-cms","labels_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19792/labels{/name}","comments_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19792/comments","events_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19792/events","html_url":"https://github.com/joomla/joomla-cms/issues/19792","id":300515582,"number":19792,"title":"[RFC] - Signed Package Validation","user":{"login":"alikon","id":181681,"avatar_url":"https://avatars0.githubusercontent.com/u/181681?v=4","gravatar_id":"","url":"https://api.github.com/users/alikon","html_url":"https://github.com/alikon","followers_url":"https://api.github.com/users/alikon/followers","following_url":"https://api.github.com/users/alikon/following{/other_user}","gists_url":"https://api.github.com/users/alikon/gists{/gist_id}","starred_url":"https://api.github.com/users/alikon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alikon/subscriptions","organizations_url":"https://api.github.com/users/alikon/orgs","repos_url":"https://api.github.com/users/alikon/repos","events_url":"https://api.github.com/users/alikon/events{/privacy}","received_events_url":"https://api.github.com/users/alikon/received_events","type":"User","site_admin":false},"labels":[{"id":138443932,"url":"https://api.github.com/repos/joomla/joomla-cms/labels/No%20Code%20Attached%20Yet","name":"No Code Attached Yet","color":"ededed","default":false},{"id":31297684,"url":"https://api.github.com/repos/joomla/joomla-cms/labels/Request%20for%20Comment","name":"Request for Comment","color":"02d7e1","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":16,"created_at":"2018-02-27T07:05:34Z","updated_at":"2018-03-20T11:50:07Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"### Incipit\r\nfrom #19748 , #17632, #17619\r\n\r\n> Package Validation\r\n>\r\n>#17632 and associated PRs somewhat address this, but it also somewhat falls in the \"too little too late\" category. If someone gains access to publish fake releases, they would publish the right checksums for their fake packages and Joomla would take it without issue. So you need signed releases as another step on top of (or instead of) checksum validation. https://core.trac.wordpress.org/ticket/39309 proposed that for WordPress, but they clearly aren't interested in it. I link it here though >because the patches provided by Scott in that item are not too far off from what we would have to add >to our core code (and in effect how you do it is all spelled out in the patch, you just have to convert it to >fit the Joomla API). Truth be told that is probably a bigger change to release management workflow >than end user workflow, but it is still an item to address.\r\n\r\n### Sign the package\r\nthe developer/mantainer sign the package with something like:\r\n```php\r\n// Generate keys\r\n$kp = ParagonIE_Sodium_Compat::crypto_sign_keypair(); \r\n// secret\r\n$sk = ParagonIE_Sodium_Compat::crypto_sign_secretkey($kp); \r\n// public\r\n$pk = ParagonIE_Sodium_Compat::crypto_sign_publickey($kp); \r\n// Sign the package\r\n$message =file_get_contents( 'com_patchtester.tar.bz2' );\r\n$signature = ParagonIE_Sodium_Compat::crypto_sign_detached($message, $sk); \r\n// Verify\r\nif (ParagonIE_Sodium_Compat::crypto_sign_verify_detached($signature, $message, $pk))\r\n{ \r\n    echo 'OK', PHP_EOL; \r\n    echo 'SecretKey:' . bin2hex($sk), PHP_EOL;\r\n    echo 'PublicKey:' . bin2hex($pk) , PHP_EOL;\r\n    echo 'Signature:' . bin2hex($signature), PHP_EOL; \r\n} \r\nelse \r\n{ \r\n   throw new Exception('Invalid signature'); \r\n} \r\n```\r\n\r\n\r\n\r\n### TAG the manifest package\r\nadd two new tags to the package manifest\r\n\r\n- publickey value from the previous step\r\n- signature value from the previous step\r\n\r\n![screenshot from 2018-02-27 07-39-01](https://user-images.githubusercontent.com/181681/36714168-57b9f288-1b91-11e8-89b2-e731fb099392.png)\r\n\r\n\r\n\r\n### Check the package signature on update\r\n from #17619  https://github.com/joomla/joomla-cms/pull/17619/files#diff-da01c5bbbd8dc2c831d18d095a3e2f16R371 change the function body` isChecksumValid($packagefile, $updateServerManifest) `as:\r\n```php\r\n$update = new \\JUpdate;\r\n$update->loadFromXml($updateServerManifest);\r\n\r\nif (!$update->get('publickey', false)->_data)\r\n{\r\n\treturn self::HASH_NOT_PROVIDED;\r\n}\r\n\r\n$pk= trim($update->get('publickey', false)->_data);\r\n$publicKey = \\ParagonIE_Sodium_Compat::hex2bin($pk);\r\n\r\nif (!$update->get('signature', false)->_data)\r\n{\r\n\treturn self::HASH_NOT_PROVIDED;\r\n}\r\n\r\n$sign = trim($update->get('signature', false)->_data);\r\n$signature = \\ParagonIE_Sodium_Compat::hex2bin($sign);\r\n$packagefile = file_get_contents($packagefile);\r\n\r\nif (\\ParagonIE_Sodium_Compat::crypto_sign_verify_detached($signature, $packagefile, $publicKey))\r\n{ \r\n\treturn self::HASH_VALIDATED;\r\n}\r\nreturn self::HASH_NOT_VALIDATED;\r\n```\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/joomla/joomla-cms/issues/comments/374569582","html_url":"https://github.com/joomla/joomla-cms/issues/19792#issuecomment-374569582","issue_url":"https://api.github.com/repos/joomla/joomla-cms/issues/19792","id":374569582,"user":{"login":"brianteeman","id":1296369,"avatar_url":"https://avatars3.githubusercontent.com/u/1296369?v=4","gravatar_id":"","url":"https://api.github.com/users/brianteeman","html_url":"https://github.com/brianteeman","followers_url":"https://api.github.com/users/brianteeman/followers","following_url":"https://api.github.com/users/brianteeman/following{/other_user}","gists_url":"https://api.github.com/users/brianteeman/gists{/gist_id}","starred_url":"https://api.github.com/users/brianteeman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brianteeman/subscriptions","organizations_url":"https://api.github.com/users/brianteeman/orgs","repos_url":"https://api.github.com/users/brianteeman/repos","events_url":"https://api.github.com/users/brianteeman/events{/privacy}","received_events_url":"https://api.github.com/users/brianteeman/received_events","type":"User","site_admin":false},"created_at":"2018-03-20T11:50:07Z","updated_at":"2018-03-20T11:50:07Z","author_association":"CONTRIBUTOR","body":"As soon as the JED adds a flag to say an extension is signed then it will be rapidly adopted. We saw this when the JED added the uses joomla updater flag"}}
{"actor":{"display_login":"brianteeman"}}