Perform extensions signature verification

XMLWordPrintableJSON

    • Type: Task
    • Resolution: Unresolved
    • Priority: Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • Query Integration
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      At the point of writing this ticket, the public key used for extensions signature verification should already be in the gpg key ring.

       

      Before loading each extension, fetch its associated .sig file (expected to live side-by-side with the .so file) and validate the signature.

       

      uassert with a helpful message if signature verification for an extension fails that the server cannot start up because a tampered extension has been detected.

       

      Use the gpgmepp library to perform the signature verification logic.

            Assignee:
            Santiago Roche
            Reporter:
            Joe Shalabi
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: