Juan Denis
95e2e6e6da
Move extension zip fetching into plugin_fetch
...
GitHub release resolution and the SSRF-guarded download (redirect
re-validation, byte caps, token scoping) were 250 lines of
plugin_service unrelated to installing. plugin_service re-exports the
names its own code calls, so existing monkeypatches on it still land;
tests that exercised the fetch internals directly now target
plugin_fetch.
2026-10-10 21:32:19 -04:00
Juan Denis
670e9d8af7
security: signature lifecycle, update-path consent gates, download hardening
...
Audit remediation (install/signing surface):
- sig verdict reset on every install path (no stale verified badge)
- registry update route mirrors install consent gates (unreviewed 404,
unsigned-first-party/untrusted 409 until acknowledged, bad sig 400);
update offers carry installed_source_type; frontend risk dialog gains
update branch
- first_party entries without verified pinned-key signature require
acknowledge (community reviewed exempt, review-stamp-bound)
- downloads: https-only with per-hop redirect revalidation, private/
link-local IP rejection, 100MB zip + 64KB sig caps, github token
https-only
- extraction: declared+actual 250MB decompression cap with cleanup
- install/update audit logs record the signature verdict
2026-08-05 13:36:20 -04:00
Juan Denis and Claude Opus 4.8
bd6b8eff33
feat(plugins): GitHub-native install with preview + permissions consent
...
Add POST /api/v1/plugins/preview: resolve a GitHub/zip source, download,
read plugin.json, and return slug/version/permissions/panel-gate + the
resolved URL, sha256, and warnings — without installing. The manual-install
URL flow becomes two-step (Resolve -> consent card -> Install), pinning the
install to the previewed sha256 so installed bytes match previewed bytes.
- owner/repo and owner/repo@tag shorthand normalization (install accepts it too).
- Actionable resolve errors: rate limit (with reset ETA), 404/private, no
plugin.json at archive root.
- Optional SERVERKIT_GITHUB_TOKEN: Bearer auth on GitHub hosts only (never
leaked to third-party mirrors, never logged); lifts the anon rate limit and
enables private-repo installs.
- ManualInstallModal: PreviewConsent card with permission chips + warnings +
'GitHub · unverified' badge; SCSS added.
Tests (test_plugin_preview.py, 15): shorthand, happy/warning preview paths,
token header injection + host scoping, preview->install checksum continuity +
tamper rejection. Full plugin suites green; frontend lint 0 errors, build clean.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-07-09 01:52:38 -04:00
Juan Denis