Update operations don't currently check against any signature

itchio / butler

🎩 Command-line itch.io helper

MIT License

745 stars 52 forks source link

Update operations don't currently check against any signature #200

Closed fasterthanlime closed 4 years ago

fasterthanlime commented 4 years ago

This line:

https://github.com/itchio/butler/blob/e8ae88f002a8e830b24538f76f9738c775990164/cmd/operate/upgrade.go#L235

is a lie.

It doesn't actually fetch signature info, and it never actually checks.

We need a way for the patcher to tell us which files were touched, or to validate in advance the files that are read from for patching (probably better?).

fasterthanlime commented 4 years ago

TODO:

[x] Write a failing test for that
- That test should install a version of a game, mess with its files, then install an update which relies on the old files being intact
- The upgrade should actually work, but we should make sure it used a heal fallback
[x] Add facility to pwr/patcher to pass in a validating pool instead