Skip to content

Commit 2ad821a

Browse files
umbynosumbynos
committedSep 11, 2023
Merge branch 'add-signature-tool-install' into test-rc
·
1.3.3-rc1
2 parents b2bceb6 + b7d18c2 commit 2ad821a

File tree

16 files changed

+305
-169
lines changed

16 files changed

+305
-169
lines changed
 

Diff for: ‎conn.go

+1-25
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,7 @@ package main
1919

2020
import (
2121
"bytes"
22-
"crypto"
23-
"crypto/rsa"
24-
"crypto/sha256"
25-
"crypto/x509"
26-
"encoding/hex"
2722
"encoding/json"
28-
"encoding/pem"
29-
"errors"
3023
"fmt"
3124
"net/http"
3225
"os"
@@ -114,7 +107,7 @@ func uploadHandler(c *gin.Context) {
114107
return
115108
}
116109

117-
err := verifyCommandLine(data.Commandline, data.Signature)
110+
err := utilities.VerifyInput(data.Commandline, data.Signature)
118111

119112
if err != nil {
120113
c.String(http.StatusBadRequest, "signature is invalid")
@@ -215,23 +208,6 @@ func send(args map[string]string) {
215208
h.broadcastSys <- mapB
216209
}
217210

218-
func verifyCommandLine(input string, signature string) error {
219-
sign, _ := hex.DecodeString(signature)
220-
block, _ := pem.Decode([]byte(*signatureKey))
221-
if block == nil {
222-
return errors.New("invalid key")
223-
}
224-
key, err := x509.ParsePKIXPublicKey(block.Bytes)
225-
if err != nil {
226-
return err
227-
}
228-
rsaKey := key.(*rsa.PublicKey)
229-
h := sha256.New()
230-
h.Write([]byte(input))
231-
d := h.Sum(nil)
232-
return rsa.VerifyPKCS1v15(rsaKey, crypto.SHA256, d, sign)
233-
}
234-
235211
func wsHandler() *WsServer {
236212
server, err := socketio.NewServer(nil)
237213
if err != nil {

Diff for: ‎design/pkgs.go

+13-4
Original file line numberDiff line numberDiff line change
@@ -110,20 +110,29 @@ var ToolPayload = Type("arduino.tool", func() {
110110
TypeName("ToolPayload")
111111

112112
Attribute("name", String, "The name of the tool", func() {
113-
Example("avrdude")
113+
Example("bossac")
114114
})
115115
Attribute("version", String, "The version of the tool", func() {
116-
Example("6.3.0-arduino9")
116+
Example("1.7.0-arduino3")
117117
})
118118
Attribute("packager", String, "The packager of the tool", func() {
119119
Example("arduino")
120120
})
121121

122122
Attribute("url", String, `The url where the package can be found. Optional.
123-
If present checksum must also be present.`)
123+
If present checksum must also be present.`, func() {
124+
Example("http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz")
125+
})
124126

125127
Attribute("checksum", String, `A checksum of the archive. Mandatory when url is present.
126-
This ensures that the package is downloaded correcly.`)
128+
This ensures that the package is downloaded correcly.`, func() {
129+
Example("SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100")
130+
})
131+
132+
Attribute("signature", String, `The signature used to sign the url. Mandatory when url is present.
133+
This ensure the security of the file downloaded`, func() {
134+
Example("382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0")
135+
})
127136

128137
Required("name", "version", "packager")
129138
})

Diff for: ‎gen/http/cli/arduino_create_agent/cli.go

+9-7
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎gen/http/openapi.json

+1-1
Large diffs are not rendered by default.

Diff for: ‎gen/http/openapi.yaml

+52-32
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ paths:
2626
type: array
2727
items:
2828
type: string
29-
example: Repudiandae dignissimos consectetur eos molestiae culpa soluta.
29+
example: Pariatur laudantium inventore qui.
3030
"400":
3131
description: Bad Request response.
3232
schema:
@@ -193,14 +193,14 @@ definitions:
193193
timeout:
194194
type: boolean
195195
description: Is the error a timeout?
196-
example: false
196+
example: true
197197
description: url invalid (default view)
198198
example:
199199
fault: false
200200
id: 123abc
201201
message: parameter 'p' must be an integer
202202
name: bad_request
203-
temporary: false
203+
temporary: true
204204
timeout: false
205205
required:
206206
- name
@@ -241,7 +241,7 @@ definitions:
241241
fault:
242242
type: boolean
243243
description: Is the error a server-side fault?
244-
example: true
244+
example: false
245245
id:
246246
type: string
247247
description: ID is a unique identifier for this particular occurrence of the problem.
@@ -261,14 +261,14 @@ definitions:
261261
timeout:
262262
type: boolean
263263
description: Is the error a timeout?
264-
example: false
264+
example: true
265265
description: url invalid (default view)
266266
example:
267-
fault: true
267+
fault: false
268268
id: 123abc
269269
message: parameter 'p' must be an integer
270270
name: bad_request
271-
temporary: true
271+
temporary: false
272272
timeout: true
273273
required:
274274
- name
@@ -284,7 +284,7 @@ definitions:
284284
fault:
285285
type: boolean
286286
description: Is the error a server-side fault?
287-
example: false
287+
example: true
288288
id:
289289
type: string
290290
description: ID is a unique identifier for this particular occurrence of the problem.
@@ -300,19 +300,19 @@ definitions:
300300
temporary:
301301
type: boolean
302302
description: Is the error temporary?
303-
example: true
303+
example: false
304304
timeout:
305305
type: boolean
306306
description: Is the error a timeout?
307-
example: true
307+
example: false
308308
description: url invalid (default view)
309309
example:
310-
fault: false
310+
fault: true
311311
id: 123abc
312312
message: parameter 'p' must be an integer
313313
name: bad_request
314314
temporary: true
315-
timeout: false
315+
timeout: true
316316
required:
317317
- name
318318
- id
@@ -352,20 +352,20 @@ definitions:
352352
name:
353353
type: string
354354
description: The name of the tool
355-
example: avrdude
355+
example: bossac
356356
packager:
357357
type: string
358358
description: The packager of the tool
359359
example: arduino
360360
version:
361361
type: string
362362
description: The version of the tool
363-
example: 6.3.0-arduino9
363+
example: 1.7.0-arduino3
364364
description: A tool is an executable program that can upload sketches. (default view)
365365
example:
366-
name: avrdude
366+
name: bossac
367367
packager: arduino
368-
version: 6.3.0-arduino9
368+
version: 1.7.0-arduino3
369369
required:
370370
- name
371371
- version
@@ -377,29 +377,36 @@ definitions:
377377
checksum:
378378
type: string
379379
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
380-
example: Totam cum inventore exercitationem in.
380+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
381381
name:
382382
type: string
383383
description: The name of the tool
384-
example: avrdude
384+
example: bossac
385385
packager:
386386
type: string
387387
description: The packager of the tool
388388
example: arduino
389+
signature:
390+
type: string
391+
description: |-
392+
The signature used to sign the url. Mandatory when url is present.
393+
This ensure the security of the file downloaded
394+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
389395
url:
390396
type: string
391397
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
392-
example: Totam vero ipsum corporis nihil voluptatem id.
398+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
393399
version:
394400
type: string
395401
description: The version of the tool
396-
example: 6.3.0-arduino9
402+
example: 1.7.0-arduino3
397403
example:
398-
checksum: Modi dolorem reprehenderit perspiciatis illo aspernatur.
399-
name: avrdude
404+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
405+
name: bossac
400406
packager: arduino
401-
url: Officia optio inventore atque in voluptatibus qui.
402-
version: 6.3.0-arduino9
407+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
408+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
409+
version: 1.7.0-arduino3
403410
required:
404411
- name
405412
- version
@@ -424,14 +431,21 @@ definitions:
424431
checksum:
425432
type: string
426433
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
427-
example: Et qui id et cumque illo.
434+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
435+
signature:
436+
type: string
437+
description: |-
438+
The signature used to sign the url. Mandatory when url is present.
439+
This ensure the security of the file downloaded
440+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
428441
url:
429442
type: string
430443
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
431-
example: Officia maiores reiciendis est nemo.
444+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
432445
example:
433-
checksum: Corporis eum et numquam sapiente.
434-
url: Est voluptatem eos reprehenderit quo sint quod.
446+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
447+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
448+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
435449
ToolsRemoveResponseBody:
436450
title: 'Mediatype identifier: application/vnd.arduino.operation; view=default'
437451
type: object
@@ -452,9 +466,15 @@ definitions:
452466
$ref: '#/definitions/ToolResponse'
453467
description: AvailableResponseBody is the result type for an array of ToolResponse (default view)
454468
example:
455-
- name: avrdude
469+
- name: bossac
470+
packager: arduino
471+
version: 1.7.0-arduino3
472+
- name: bossac
473+
packager: arduino
474+
version: 1.7.0-arduino3
475+
- name: bossac
456476
packager: arduino
457-
version: 6.3.0-arduino9
458-
- name: avrdude
477+
version: 1.7.0-arduino3
478+
- name: bossac
459479
packager: arduino
460-
version: 6.3.0-arduino9
480+
version: 1.7.0-arduino3

Diff for: ‎gen/http/openapi3.json

+1-1
Large diffs are not rendered by default.

Diff for: ‎gen/http/openapi3.yaml

+72-56
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,17 @@ paths:
2222
type: array
2323
items:
2424
type: string
25-
example: Eveniet iure nihil optio qui.
25+
example: Rerum et soluta laudantium.
2626
example:
27-
- Et perferendis eveniet voluptas.
28-
- Ut aut illum eaque dolor magni.
29-
- Amet illo veritatis laudantium optio.
27+
- Et deserunt.
28+
- Impedit iusto libero explicabo.
29+
- Dolor adipisci nulla.
30+
- Quam voluptas voluptates expedita rem ipsum.
3031
example:
31-
- Illo enim vero qui rerum ut inventore.
32-
- Dolorem nihil autem minima alias.
32+
- Dignissimos consectetur eos molestiae culpa soluta deserunt.
33+
- Nobis sint dolorem unde.
34+
- Quia doloremque.
35+
- Atque iusto tempore sit quod dolor repellat.
3336
"400":
3437
description: 'invalid_url: url invalid'
3538
content:
@@ -108,15 +111,15 @@ paths:
108111
schema:
109112
$ref: '#/components/schemas/ToolCollection'
110113
example:
111-
- name: avrdude
114+
- name: bossac
112115
packager: arduino
113-
version: 6.3.0-arduino9
114-
- name: avrdude
116+
version: 1.7.0-arduino3
117+
- name: bossac
115118
packager: arduino
116-
version: 6.3.0-arduino9
117-
- name: avrdude
119+
version: 1.7.0-arduino3
120+
- name: bossac
118121
packager: arduino
119-
version: 6.3.0-arduino9
122+
version: 1.7.0-arduino3
120123
/v2/pkgs/tools/installed:
121124
get:
122125
tags:
@@ -131,15 +134,15 @@ paths:
131134
schema:
132135
$ref: '#/components/schemas/ToolCollection'
133136
example:
134-
- name: avrdude
137+
- name: bossac
135138
packager: arduino
136-
version: 6.3.0-arduino9
137-
- name: avrdude
139+
version: 1.7.0-arduino3
140+
- name: bossac
138141
packager: arduino
139-
version: 6.3.0-arduino9
140-
- name: avrdude
142+
version: 1.7.0-arduino3
143+
- name: bossac
141144
packager: arduino
142-
version: 6.3.0-arduino9
145+
version: 1.7.0-arduino3
143146
post:
144147
tags:
145148
- tools
@@ -152,11 +155,12 @@ paths:
152155
schema:
153156
$ref: '#/components/schemas/InstallRequestBody'
154157
example:
155-
checksum: Beatae dolor adipisci nulla et quam voluptas.
156-
name: avrdude
158+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
159+
name: bossac
157160
packager: arduino
158-
url: Deserunt voluptatem impedit iusto libero.
159-
version: 6.3.0-arduino9
161+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
162+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
163+
version: 1.7.0-arduino3
160164
responses:
161165
"200":
162166
description: OK response.
@@ -189,26 +193,27 @@ paths:
189193
schema:
190194
type: string
191195
description: The name of the tool
192-
example: avrdude
193-
example: avrdude
196+
example: bossac
197+
example: bossac
194198
- name: version
195199
in: path
196200
description: The version of the tool
197201
required: true
198202
schema:
199203
type: string
200204
description: The version of the tool
201-
example: 6.3.0-arduino9
202-
example: 6.3.0-arduino9
205+
example: 1.7.0-arduino3
206+
example: 1.7.0-arduino3
203207
requestBody:
204208
required: true
205209
content:
206210
application/json:
207211
schema:
208212
$ref: '#/components/schemas/RemoveRequestBody'
209213
example:
210-
checksum: Ipsa minima quia.
211-
url: Expedita rem ipsum quasi harum nostrum.
214+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
215+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
216+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
212217
responses:
213218
"200":
214219
description: OK response.
@@ -237,20 +242,20 @@ components:
237242
name:
238243
type: string
239244
description: The name of the tool
240-
example: avrdude
245+
example: bossac
241246
packager:
242247
type: string
243248
description: The packager of the tool
244249
example: arduino
245250
version:
246251
type: string
247252
description: The version of the tool
248-
example: 6.3.0-arduino9
253+
example: 1.7.0-arduino3
249254
description: A tool is an executable program that can upload sketches.
250255
example:
251-
name: avrdude
256+
name: bossac
252257
packager: arduino
253-
version: 6.3.0-arduino9
258+
version: 1.7.0-arduino3
254259
required:
255260
- name
256261
- version
@@ -277,7 +282,7 @@ components:
277282
temporary:
278283
type: boolean
279284
description: Is the error temporary?
280-
example: false
285+
example: true
281286
timeout:
282287
type: boolean
283288
description: Is the error a timeout?
@@ -288,8 +293,8 @@ components:
288293
id: 123abc
289294
message: parameter 'p' must be an integer
290295
name: bad_request
291-
temporary: false
292-
timeout: true
296+
temporary: true
297+
timeout: false
293298
required:
294299
- name
295300
- id
@@ -303,29 +308,36 @@ components:
303308
checksum:
304309
type: string
305310
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
306-
example: Sint odio sed consequatur numquam.
311+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
307312
name:
308313
type: string
309314
description: The name of the tool
310-
example: avrdude
315+
example: bossac
311316
packager:
312317
type: string
313318
description: The packager of the tool
314319
example: arduino
320+
signature:
321+
type: string
322+
description: |-
323+
The signature used to sign the url. Mandatory when url is present.
324+
This ensure the security of the file downloaded
325+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
315326
url:
316327
type: string
317328
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
318-
example: Et quo doloremque sapiente atque.
329+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
319330
version:
320331
type: string
321332
description: The version of the tool
322-
example: 6.3.0-arduino9
333+
example: 1.7.0-arduino3
323334
example:
324-
checksum: Mollitia commodi sunt.
325-
name: avrdude
335+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
336+
name: bossac
326337
packager: arduino
327-
url: Quae reprehenderit provident provident debitis illo.
328-
version: 6.3.0-arduino9
338+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
339+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
340+
version: 1.7.0-arduino3
329341
required:
330342
- name
331343
- version
@@ -347,31 +359,35 @@ components:
347359
checksum:
348360
type: string
349361
description: "A checksum of the archive. Mandatory when url is present. \n\tThis ensures that the package is downloaded correcly."
350-
example: Ea culpa.
362+
example: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
363+
signature:
364+
type: string
365+
description: |-
366+
The signature used to sign the url. Mandatory when url is present.
367+
This ensure the security of the file downloaded
368+
example: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
351369
url:
352370
type: string
353371
description: "The url where the package can be found. Optional. \n\tIf present checksum must also be present."
354-
example: Odit officiis illo qui quia provident illo.
372+
example: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
355373
example:
356-
checksum: Rerum eum esse corporis ex.
357-
url: Molestiae dolor quaerat enim.
374+
checksum: SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100
375+
signature: 382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0
376+
url: http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz
358377
ToolCollection:
359378
type: array
360379
items:
361380
$ref: '#/components/schemas/ArduinoTool'
362381
example:
363-
- name: avrdude
364-
packager: arduino
365-
version: 6.3.0-arduino9
366-
- name: avrdude
382+
- name: bossac
367383
packager: arduino
368-
version: 6.3.0-arduino9
369-
- name: avrdude
384+
version: 1.7.0-arduino3
385+
- name: bossac
370386
packager: arduino
371-
version: 6.3.0-arduino9
372-
- name: avrdude
387+
version: 1.7.0-arduino3
388+
- name: bossac
373389
packager: arduino
374-
version: 6.3.0-arduino9
390+
version: 1.7.0-arduino3
375391
tags:
376392
- name: indexes
377393
description: The indexes service manages the package_index files

Diff for: ‎gen/http/tools/client/cli.go

+11-9
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎gen/http/tools/client/types.go

+15-7
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎gen/http/tools/server/types.go

+15-7
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎gen/tools/service.go

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎globals/globals.go

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
// Copyright 2022 Arduino SA
2+
//
3+
// This program is free software: you can redistribute it and/or modify
4+
// it under the terms of the GNU Affero General Public License as published
5+
// by the Free Software Foundation, either version 3 of the License, or
6+
// (at your option) any later version.
7+
//
8+
// This program is distributed in the hope that it will be useful,
9+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11+
// GNU Affero General Public License for more details.
12+
//
13+
// You should have received a copy of the GNU Affero General Public License
14+
// along with this program. If not, see <https://www.gnu.org/licenses/>.
15+
16+
package globals
17+
18+
// DefaultIndexURL is the default index url
19+
var (
20+
// SignatureKey is the public key used to verify commands and url sent by the builder
21+
SignatureKey = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF\nIE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1\nZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1\npFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z\nCeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn\n2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9\ntwIDAQAB\n-----END PUBLIC KEY-----"
22+
)

Diff for: ‎main.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ import (
3434
cors "github.com/andela/gin-cors"
3535
cert "github.com/arduino/arduino-create-agent/certificates"
3636
"github.com/arduino/arduino-create-agent/config"
37+
"github.com/arduino/arduino-create-agent/globals"
3738
"github.com/arduino/arduino-create-agent/systray"
3839
"github.com/arduino/arduino-create-agent/tools"
3940
"github.com/arduino/arduino-create-agent/updater"
@@ -78,7 +79,7 @@ var (
7879
logDump = iniConf.String("log", "off", "off = (default)")
7980
origins = iniConf.String("origins", "", "Allowed origin list for CORS")
8081
regExpFilter = iniConf.String("regex", "usb|acm|com", "Regular expression to filter serial port list")
81-
signatureKey = iniConf.String("signatureKey", "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvc0yZr1yUSen7qmE3cxF\nIE12rCksDnqR+Hp7o0nGi9123eCSFcJ7CkIRC8F+8JMhgI3zNqn4cUEn47I3RKD1\nZChPUCMiJCvbLbloxfdJrUi7gcSgUXrlKQStOKF5Iz7xv1M4XOP3JtjXLGo3EnJ1\npFgdWTOyoSrA8/w1rck4c/ISXZSinVAggPxmLwVEAAln6Itj6giIZHKvA2fL2o8z\nCeK057Lu8X6u2CG8tRWSQzVoKIQw/PKK6CNXCAy8vo4EkXudRutnEYHEJlPkVgPn\n2qP06GI+I+9zKE37iqj0k1/wFaCVXHXIvn06YrmjQw6I0dDj/60Wvi500FuRVpn9\ntwIDAQAB\n-----END PUBLIC KEY-----", "Pem-encoded public key to verify signed commandlines")
82+
signatureKey = iniConf.String("signatureKey", globals.SignatureKey, "Pem-encoded public key to verify signed commandlines")
8283
updateURL = iniConf.String("updateUrl", "", "")
8384
verbose = iniConf.Bool("v", true, "show debug logging")
8485
crashreport = iniConf.Bool("crashreport", false, "enable crashreport logging")

Diff for: ‎main_test.go

+53-18
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"crypto/x509"
2121
"encoding/json"
2222
"encoding/pem"
23+
"fmt"
2324
"io"
2425
"net/http"
2526
"net/http/httptest"
@@ -48,34 +49,68 @@ func TestValidSignatureKey(t *testing.T) {
4849
require.NotNil(t, key)
4950
}
5051

51-
func TestInstallToolDifferentContentType(t *testing.T) {
52+
func TestInstallToolV2(t *testing.T) {
5253
r := gin.New()
5354
goa := v2.Server(config.GetDataDir().String())
5455
r.Any("/v2/*path", gin.WrapH(goa))
5556
ts := httptest.NewServer(r)
5657

57-
URL := "http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz"
58-
Checksum := "SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100"
59-
request := tools.ToolPayload{
58+
type test struct {
59+
request tools.ToolPayload
60+
responseCode int
61+
responseBody string
62+
}
63+
64+
BossacURL := "http://downloads.arduino.cc/tools/bossac-1.7.0-arduino3-linux64.tar.gz"
65+
BossacChecksum := "SHA-256:1ae54999c1f97234a5c603eb99ad39313b11746a4ca517269a9285afa05f9100"
66+
BossacSignature := "382898a97b5a86edd74208f10107d2fecbf7059ffe9cc856e045266fb4db4e98802728a0859cfdcda1c0b9075ec01e42dbea1f430b813530d5a6ae1766dfbba64c3e689b59758062dc2ab2e32b2a3491dc2b9a80b9cda4ae514fbe0ec5af210111b6896976053ab76bac55bcecfcececa68adfa3299e3cde6b7f117b3552a7d80ca419374bb497e3c3f12b640cf5b20875416b45e662fc6150b99b178f8e41d6982b4c0a255925ea39773683f9aa9201dc5768b6fc857c87ff602b6a93452a541b8ec10ca07f166e61a9e9d91f0a6090bd2038ed4427af6251039fb9fe8eb62ec30d7b0f3df38bc9de7204dec478fb86f8eb3f71543710790ee169dce039d3e0"
67+
bossacInstallURLOK := tools.ToolPayload{
68+
Name: "bossac",
69+
Version: "1.7.0-arduino3",
70+
Packager: "arduino",
71+
URL: &BossacURL,
72+
Checksum: &BossacChecksum,
73+
Signature: &BossacSignature,
74+
}
75+
76+
WrongSignature := "wr0ngs1gn4tur3"
77+
bossacInstallWrongSig := tools.ToolPayload{
78+
Name: "bossac",
79+
Version: "1.7.0-arduino3",
80+
Packager: "arduino",
81+
URL: &BossacURL,
82+
Checksum: &BossacChecksum,
83+
Signature: &WrongSignature,
84+
}
85+
86+
bossacInstallNoURL := tools.ToolPayload{
6087
Name: "bossac",
6188
Version: "1.7.0-arduino3",
6289
Packager: "arduino",
63-
URL: &URL,
64-
Checksum: &Checksum,
6590
}
6691

67-
payload, err := json.Marshal(request)
68-
require.NoError(t, err)
92+
tests := []test{
93+
{bossacInstallURLOK, http.StatusOK, "ok"},
94+
{bossacInstallWrongSig, http.StatusInternalServerError, "verification error"},
95+
{bossacInstallNoURL, http.StatusBadRequest, "tool not found"}, //because the index is not added
96+
}
97+
98+
for _, test := range tests {
99+
t.Run(fmt.Sprintf("Installing %s", test.request.Name), func(t *testing.T) {
100+
payload, err := json.Marshal(test.request)
101+
require.NoError(t, err)
69102

70-
// for some reason the fronted sends requests with "text/plain" content type.
71-
// Even if the request body contains a json object.
72-
// With this test we verify is parsed correctly.
73-
for _, encoding := range []string{"encoding/json", "text/plain"} {
74-
resp, err := http.Post(ts.URL+"/v2/pkgs/tools/installed", encoding, bytes.NewBuffer(payload))
75-
require.NoError(t, err)
76-
body, err := io.ReadAll(resp.Body)
77-
require.NoError(t, err)
78-
require.Contains(t, string(body), "ok")
79-
require.Equal(t, http.StatusOK, resp.StatusCode)
103+
// for some reason the fronted sends requests with "text/plain" content type.
104+
// Even if the request body contains a json object.
105+
// With this test we verify is parsed correctly.
106+
for _, encoding := range []string{"encoding/json", "text/plain"} {
107+
resp, err := http.Post(ts.URL+"/v2/pkgs/tools/installed", encoding, bytes.NewBuffer(payload))
108+
require.NoError(t, err)
109+
body, err := io.ReadAll(resp.Body)
110+
require.NoError(t, err)
111+
require.Contains(t, string(body), test.responseBody)
112+
require.Equal(t, test.responseCode, resp.StatusCode)
113+
}
114+
})
80115
}
81116
}

Diff for: ‎utilities/utilities.go

+27
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,20 @@ package utilities
1818
import (
1919
"archive/zip"
2020
"bytes"
21+
"crypto"
22+
"crypto/rsa"
23+
"crypto/sha256"
24+
"crypto/x509"
25+
"encoding/hex"
26+
"encoding/pem"
2127
"errors"
2228
"io"
2329
"os"
2430
"os/exec"
2531
"path"
2632
"path/filepath"
33+
34+
"github.com/arduino/arduino-create-agent/globals"
2735
)
2836

2937
// SaveFileonTempDir creates a temp directory and saves the file data as the
@@ -141,3 +149,22 @@ func Unzip(zippath string, destination string) (err error) {
141149
}
142150
return
143151
}
152+
153+
// VerifyInput will verify an input against a signature
154+
// A valid signature is indicated by returning a nil error.
155+
func VerifyInput(input string, signature string) error {
156+
sign, _ := hex.DecodeString(signature)
157+
block, _ := pem.Decode([]byte(globals.SignatureKey))
158+
if block == nil {
159+
return errors.New("invalid key")
160+
}
161+
key, err := x509.ParsePKIXPublicKey(block.Bytes)
162+
if err != nil {
163+
return err
164+
}
165+
rsaKey := key.(*rsa.PublicKey)
166+
h := sha256.New()
167+
h.Write([]byte(input))
168+
d := h.Sum(nil)
169+
return rsa.VerifyPKCS1v15(rsaKey, crypto.SHA256, d, sign)
170+
}

Diff for: ‎v2/pkgs/tools.go

+8-1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ import (
3131
"strings"
3232

3333
"github.com/arduino/arduino-create-agent/gen/tools"
34+
"github.com/arduino/arduino-create-agent/utilities"
3435
"github.com/codeclysm/extract/v3"
3536
)
3637

@@ -135,10 +136,16 @@ func (c *Tools) Installed(ctx context.Context) (tools.ToolCollection, error) {
135136
func (c *Tools) Install(ctx context.Context, payload *tools.ToolPayload) (*tools.Operation, error) {
136137
path := filepath.Join(payload.Packager, payload.Name, payload.Version)
137138

138-
if payload.URL != nil {
139+
//if URL is defined and is signed we verify the signature and override the name, payload, version parameters
140+
if payload.URL != nil && payload.Signature != nil && payload.Checksum != nil {
141+
err := utilities.VerifyInput(*payload.URL, *payload.Signature)
142+
if err != nil {
143+
return nil, err
144+
}
139145
return c.install(ctx, path, *payload.URL, *payload.Checksum)
140146
}
141147

148+
// otherwise we install from the loaded indexes
142149
list, err := c.Indexes.List(ctx)
143150
if err != nil {
144151
return nil, err

0 commit comments

Comments
 (0)
Please sign in to comment.