fix(update-agent): enforce signed-manifest verification for octet-stream components - #1391
Open
Cr0wTom wants to merge 2 commits into
Open
Conversation
… manifest (observe mode)
Cr0wTom
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Octet-stream components are installed as downloaded but were verified only against the unsigned
source.hash— never the signedmanifest_component.hash, allowing payload substitution under a valid signature.Fix:
process()verifies the blob against the signed manifest size+hash (samecheck_existing_componentthe compressed path uses) and fails the update on mismatch. Fleet-safety basis: the manifest hash is the final-component hash, already hard-enforced on XZ/bidiff paths, and for octet-stream the final component is byte-identical to the download — the same generator that produces correct XZ hashes produces blob hashes here by construction (corroborated by the E2E fixture). A false reject fails only that rollout and is recoverable backend-side by regenerating the claim; devices install nothing. This PR cannot block its own rollout (it is verified by the old agent).Tests: check passes/fails correctly on match/hash/size divergence; mismatch fails
process()(run in Linux CI).Mitigates: VULN-220 (fixed); octet-stream element of VULN-6331/6332; external disclosure report (Sep 2026), payload-substitution finding. Part 3/3 of claim hardening.