search

nextcloud / updater

:arrows_counterclockwise: The updater app to keep your Nextcloud up-to-date
GNU Affero General Public License v3.0
45 stars 33 forks source link

[stable26] fix: Correctly check result of function #561

Closed backportbot[bot] closed 4 months ago

backportbot[bot] commented 4 months ago

Backport of #556

Warning, This backport's changes differ from the original and might be incomplete ⚠️

Todo

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

blizzz commented 4 months ago

phar got updated:

$ grep -A6 -a openssl_verify updater.phar 
                $validSignature = openssl_verify(
                        file_get_contents($this->getDownloadedFilePath()),
                        base64_decode($response['signature']),
                        $certificate,
                        OPENSSL_ALGO_SHA512
                ) === 1;
blizzz commented 4 months ago

P.S.: i was irritated about the 6 bytes difference. It is dropping " dirty" from the version, which is applied automatically when the updater.phar is built while the git repo is not clean (e.g. due to new hashes in vendor/composer/installed.php if you don't pay attention)

blizzz commented 4 months ago

master is expected to fail