-
Type:
Task
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
-
Query Integration
-
Fully Compatible
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Add the config flag 'extensions_signature_verification_secure' to bazel bazel/config/BUILD.bazel file. Make sure it is false be default (with 'build_setting_default = False'). Create an alias for the flag like all others. Set the flag to true in the public-release config.
Then add a preprocessor macro called 'MONGO_CONFIG_EXT_SIG_SECURE' in the src/mongo/BUILD.bazel file. To do this well need to make a config_setting in bazel/config/BUILD.bazel called 'extensions_signature_verification_secure_enabled' which should be true if release is true OR 'extensions_signature_verification_secure' is true. Im not exactly sure how to implement the OR condition, but I assume it must be possible.
- is depended on by
-
SERVER-115283 Update package release verifier to ensure extensions sig insecure mode never active in for release builds
-
- Open
-
-
SERVER-115288 Add extensions gpg key to ring in secure mode
-
- Open
-
-
SERVER-115282 Add --extensionsSignaturePubKeyPath server flag
-
- In Code Review
-