search

nextcloud / server

☁️ Nextcloud server, a safe home for all your data
https://nextcloud.com
GNU Affero General Public License v3.0
27.38k stars 4.07k forks source link

Code integrity check #9375

Open nickvergessen opened 6 years ago

nickvergessen commented 6 years ago

There are currently multiple problems with the code integrity check, which should be tackled at some point:

  1. Integrity is only checked after an update, but for everything
  2. Integrity of an app is not checked after an update from the appstore
  3. The code of the app is run (updater) before doing the integrity check.
  4. The integrity check is currently synchronous while running the update (maintenance mode on) but takes a lot of time

Things that should change:

  1. Integrity check should be run before the update (of server and app), so we only run signed code (although for the server this is somewhat unrealistic, because you replaced the files before already, so an attack case can not be covered, only a "borked" upload.
  2. Integrity check should be ran for the specific app when updating via the app store
  3. When updating via console the integrity check should be optional, to allow faster deployment across multiple instances when you use a deployment tool (chef, puppet, git, ...).

cc @MorrisJobke @rullzer

Mannshoch commented 6 years ago

how could I deactivate integrity check? At moment I get this error on every nextcloud update and I have to remove apps Manually and install them again. At moment I ignore it but It would be nice if I could somehow get ride of this Infobar.

szaimen commented 3 years ago

I suppose this issue is still valid? If not, please close this issue!