feat(deploy): implement signed packages verification and hardened extraction security - #1173
Open
matias-easymile wants to merge 15 commits into
Open
Conversation
Member
|
thank you for your PR, I still saw you were working on this feature few weeks ago. It is definitively interesting. I took a quick look by now and I see few problems:
|
matias-easymile
force-pushed
the
contrib/deploy-signature-verification
branch
from
June 3, 2026 15:22
6cb207e to
4af59a0
Compare
Author
|
Thanks for your quick feedbacks, we kindly took care of the contributing section of the project before pushing this MR. Concerning your feedbacks:
=> we reviewed the commits included in the branch and removed unwanted commits from develop.
=> My mistake.. this was a temporary file used to patch the spec file. I removed it. I force pushed the contrib branch with thoses changes, waited for green CI in my fork and returned to you with this comment. Regards |
Member
|
I won't be able to review your PR before next release. But I'll do for possible inclusion in v1.19. |
Member
|
I released v1.18 today. I'll now be able to take a deeper look on your PR. By now, this release includes few changes related to security issues in Deploy and even in Tools::Archive. I think the v1.18 changed code is not colliding yours, but can you rebase your PR against current develop branch and push forced again ? |
… packages This commit introduces cryptographic signature verification for deployment packages in the Deploy task. Key features: - Support for Ed25519 signatures using Crypt::Ed25519. - Added deploy-public-key configuration option. - Added tools/glpi-sign-package.pl to generate signed manifests. - Comprehensive test suite in t/tasks/deploy/signature.t. - Security checks against path traversal and hash mismatches.
This commit introduces the following security enhancements: - Added 'secure-extraction' configuration option (default to 'no'). - When 'secure-extraction' is enabled, the Archive tool rejects files with path traversal attempts (Zip Slip protection). - Hardened Deploy task: load the public key into memory before extraction to prevent archives from overwriting it and bypassing verification. - Added '--secure-extraction' support to the Linux installer. - Updated documentation in agent.cfg and Task/Deploy.pm. - Updated test suite to verify optional secure extraction.
…ign-package.pl - Fix argument order in Crypt::Ed25519::verify and sign calls. - Add support for PEM and PKCS#8 Ed25519 private keys in signing tool. - Fix path calculation bug in glpi-sign-package.pl during directory traversal. - Enhanced POD documentation for signing tool and Deploy task. - Added signing tool reference in CONTRIB.md. - Updated tests to match corrected argument order.
This ensures that the Crypt::Ed25519 module is included in the agent packages for macOS, Windows, Debian/Ubuntu, and RPM-based systems, enabling the signed packages verification feature out of the box.
If Crypt::Ed25519 is missing in the system Perl, the script will now automatically try to execute itself using the GLPI Agent bundled Perl (on Windows or macOS) to provide a seamless cross-platform experience.
…kages The libcrypt-ed25519-perl package is not available in older distributions (like Ubuntu Bionic 18.04), which breaks the AppImage build and prevents installation. Moved Crypt::Ed25519 from a strict Depends/Requires to Recommends/Suggests. The Deploy task already lazy-loads the module at runtime, so it will gracefully handle its absence unless package signature verification is actually used.
- Removed duplicated _movedll calls in Step 11 which caused 'movefile' to fail. - Cleaned up redundant module installation in Step 5. - Kept Crypt::Ed25519 for signature verification support.
- Extended glpi-sign-package.pl with --command option to sign shell commands. - Updated Deploy task to verify command signatures against signed manifest. - Fixed Windows build failure for Crypt::Rijndael by using -std=gnu17.
Added a "KEY GENERATION" section to the POD documentation explaining how to generate the required Ed25519 key pair using OpenSSL and extract the public key for the agent configuration.
Address review comments for Deploy.pm, SPEC, and test files.
matias-easymile
force-pushed
the
contrib/deploy-signature-verification
branch
from
June 23, 2026 17:47
4af59a0 to
9313c77
Compare
Author
|
Hi @g-bougard, Thanks for your time and your feedback, I've just rebased and force pushed the branch as requested, |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary:
This Merge Request introduces a modern cryptographic signature verification mechanism for the Deploy task and enhances the security of the
package extraction process. It adds support for Ed25519 signatures to ensure the authenticity and integrity of deployment packages.
Key Features:
manifest before execution.
it on disk.
Technical Details:
bypass attempts, and path traversal).