The updater checks something the release server cannot change #189

New Issue

2026-11-11T05:58:41Z

james.maes commented

2026-11-11 05:58:41 +00:00

From the release reviews of 1.1.1 (2026-11-10). Not part of 1.1.1; planned for 1.2.0 unless said otherwise.

The in-app updater verifies each package against the size and hash in the feed, and feed and packages come from the same server (ADR 0009; accepted for 1.1.1 as T1 in the threat model). The binaries are Authenticode-signed, but the updater does not look at the signature.

Wanted

Before an update is applied, verify the publisher of the downloaded package (its Authenticode signer), or a feed that is signed with a key the server does not hold. Then update the T1 and T2 rows.

To find out first: what Velopack offers for this, and whether its Gitea source takes download URLs from the server's answer (then HTTPS for the downloads depends on the server's configured root URL).

From the release reviews of 1.1.1 (2026-11-10). Not part of 1.1.1; planned for 1.2.0 unless said otherwise. The in-app updater verifies each package against the size and hash in the feed, and feed and packages come from the same server (ADR 0009; accepted for 1.1.1 as T1 in the threat model). The binaries are Authenticode-signed, but the updater does not look at the signature. ## Wanted Before an update is applied, verify the publisher of the downloaded package (its Authenticode signer), or a feed that is signed with a key the server does not hold. Then update the T1 and T2 rows. To find out first: what Velopack offers for this, and whether its Gitea source takes download URLs from the server's answer (then HTTPS for the downloads depends on the server's configured root URL).

james.maes added the deferred enhancement labels 2026-11-11 05:58:41 +00:00

james.maes commented

2026-11-11 06:14:57 +00:00

Two things to check when this is taken up, both noted by the security review and not verified from source: whether Velopack's Gitea source takes download URLs from the server's answer (then HTTPS for downloads depends on the server's configured root URL), and how libgit2 treats a redirect to another host on the first request of a fetch (only the listed host can issue it). Since #184 a folder's own http.followRedirects is refused; the default behaviour is what remains to be read.

Two things to check when this is taken up, both noted by the security review and not verified from source: whether Velopack's Gitea source takes download URLs from the server's answer (then HTTPS for downloads depends on the server's configured root URL), and how libgit2 treats a redirect to another host on the first request of a fetch (only the listed host can issue it). Since #184 a folder's own `http.followRedirects` is refused; the default behaviour is what remains to be read.

james.maes referenced this issue

2026-11-11 06:27:42 +00:00

Release v1.2.0 #200

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#189