search

edvin / fxlauncher

Auto updating launcher for JavaFX Applications
Apache License 2.0
714 stars 110 forks source link

Add security by checking for signature. #82

Closed mordechaim closed 7 years ago

mordechaim commented 7 years ago

Using an automatic launcher opens up the user's computer to malicious files. If -- in any event -- the remote server is compromised a hacker can cause automatic download of their file to all users.

The most basic security could be added by bundling the developer's public certificate in the installation and passing the file location to the launcher as a command-line argument. It should be matched with the jar-signing on every update. It should reject the file if it fails.

Of course this could be completely optional, but it is an extremely important addition if this project is used for a popular software.

edvin commented 7 years ago

I've been wanting to do something like this for a while, and it's a must for popular software as you point out. My plate is completely full at the moment, so unless somebody beats me to it it's going to be a while before I can get to it, but this needs to be done for sure :)

mordechaim commented 7 years ago

No problem, I'll fork it and do it myself. I'm very enthusiastic for this project.

edvin commented 7 years ago

Great to hear :) I will of course be available to discuss the feature if you need to bounce some ideas :)