Repository navigation
Conversation
zeroshade
force-pushed
the
fix/install-verify-signatures
branch
from
October 28, 2026 23:29
63c720e to
f9c504b
Compare
SignedByColumnar's deprecation note says Client.Install verifies signatures, but Client.Install passes no verifier to config.InstallPackage, so library installs accept a driver whose library was modified after signing. VerifyPackageSignature (a config.PackageVerifier) now holds the check the CLI ran in verifySignatureInStaging; Client.Install passes it unless the caller opts out with AllowUnsigned, and the CLI delegates to it. Verification runs on the staged package, so a rejected driver leaves an existing install in place.
zeroshade
force-pushed
the
fix/install-verify-signatures
branch
from
October 29, 2026 17:07
f9c504b to
04e39d9
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SignedByColumnar's deprecation note saysClient.Installverifies signatures, but onmainit still doesn't: it callsconfig.InstallPackagewith emptyInstallPackageOptions, so library installs (and, via later PRs, npm/Rust installs) accept a driver whose library was modified after signing. Only the CLI verified.This plugs into #502's transaction hook instead of adding a separate staging step:
dbc.VerifyPackageSignature(stagingDir, manifest)matchesconfig.PackageVerifier. It is the check the CLI ran inverifySignatureInStaging, moved into the library; the CLI now delegates to it, with identical error messages.Client.Installpasses it as theVerifierunless the caller givesdbc.AllowUnsigned(), the library counterpart of--no-verify.Behaviour change: unsigned or tampered drivers installed through the library now fail unless the caller passes
AllowUnsigned().Tests:
TestClientInstallVerifiesSignature(new tampered fixture is rejected with no registration;AllowUnsignedinstalls it) andTestClientInstallFailedVerificationKeepsExistingInstall.(Archive path-traversal hardening was dropped from this PR: #502's
validatePackageFilenamealready rejects../, separators and reserved names before anything is written.)