mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 05:24:49 +09:00
Juan DenisandClaude Fable 5
db4b403a59
The updater could install an unverified binary three ways: it skipped verification when no checksums URL was given, returned success when no checksum line matched the platform, and ignored the HTTP status of the checksums fetch (a 404 body parsed to an empty map → skipped). Since the updater runs as the agent process (root on packaged installs), that was a code-execution primitive that bypassed every feature gate. - Refuse to install without a checksums URL. - Extract a pure, fail-closed matchChecksum: empty/unparseable body, no entry for this GOOS/GOARCH, or a mismatch all error (was a silent skip). - Check the checksums fetch HTTP status. - requireSecureURL rejects non-HTTPS update/checksum URLs (dev override via SERVERKIT_INSECURE_TLS). - updater_test.go: 6 tests covering match/mismatch/no-entry/empty/case/https. Cryptographic release signing remains the recommended next layer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>