Fix ValidateSignatures

preload package without signing can be installed.

Change-Id: I7567f4067a376f62b75630fe137f7907a32cbdd3
Signed-off-by: Sangyoon Jang <s89.jang@samsung.com>

diff --git a/src/common/certificate_validation.cc b/src/common/certificate_validation.cc
index 481ea95..0d5e2f6 100644 (file)
--- a/src/common/certificate_validation.cc
+++ b/src/common/certificate_validation.cc
@@ -173,7 +173,7 @@ bool CheckDistSignature(const ValidationCore::SignatureFileInfo& file_info) {
 
 bool ValidateSignatures(const bf::path& base_path,
     PrivilegeLevel* level, common_installer::CertificateInfo* cert_info,
-    bool check_reference, std::string* error_message) {
+    bool check_reference, bool is_preload, std::string* error_message) {
   // Find signature files
   ValidationCore::SignatureFileInfoSet signature_files;
   ValidationCore::SignatureFinder signature_finder(base_path.string());
@@ -190,7 +190,7 @@ bool ValidateSignatures(const bf::path& base_path,
   bool distributor_signatures = std::any_of(
       signature_files.begin(), signature_files.end(), CheckDistSignature);
 
-  if (!author_signatures || !distributor_signatures) {
+  if (!is_preload && (!author_signatures || !distributor_signatures)) {
     LOG(ERROR) << "Author or distribuor signature is missing.";
     return false;
   }

diff --git a/src/common/certificate_validation.h b/src/common/certificate_validation.h
index 6287883..db00d79 100644 (file)
--- a/src/common/certificate_validation.h
+++ b/src/common/certificate_validation.h
@@ -34,7 +34,7 @@ bool ValidateSignatureFile(
 
 bool ValidateSignatures(const boost::filesystem::path& base_path,
     PrivilegeLevel* level, common_installer::CertificateInfo* cert_info,
-    bool check_reference, std::string* error_message);
+    bool check_reference, bool is_preload, std::string* error_message);
 
 bool ValidatePrivilegeLevel(common_installer::PrivilegeLevel level,
     bool is_webapp, const char* api_version, GList* privileges,

diff --git a/src/common/step/security/step_check_signature.cc b/src/common/step/security/step_check_signature.cc
index 9ec9e0a..5ef7889 100644 (file)
--- a/src/common/step/security/step_check_signature.cc
+++ b/src/common/step/security/step_check_signature.cc
@@ -54,11 +54,12 @@ Step::Status StepCheckSignature::precheck() {
 }
 
 Step::Status StepCheckSignature::CheckSignatures(bool check_reference,
+                                                 bool is_preload,
                                                  PrivilegeLevel* level) {
   std::string error_message;
   if (!ValidateSignatures(context_->unpacked_dir_path.get(), level,
                          &context_->certificate_info.get(), check_reference,
-                         &error_message)) {
+                         is_preload, &error_message)) {
     on_error(Status::CERT_ERROR, error_message);
     return Status::CERT_ERROR;
   }
@@ -106,8 +107,8 @@ Step::Status StepCheckSignature::process() {
       (context_->request_type.get()== ci::RequestType::ManifestDirectInstall ||
       context_->request_type.get() == ci::RequestType::ManifestDirectUpdate))
     check_reference = false;
-
-  Status status = CheckSignatures(check_reference, &level);
+  bool is_preload = context_->is_preload_request.get();
+  Status status = CheckSignatures(check_reference, is_preload, &level);
   if (status != Status::OK)
     return status;
 
@@ -115,7 +116,7 @@ Step::Status StepCheckSignature::process() {
   if (status != Status::OK)
     return status;
 
-  if (context_->is_preload_request.get())
+  if (is_preload)
     level = PrivilegeLevel::PLATFORM;
 
   if (level == PrivilegeLevel::UNTRUSTED) {

diff --git a/src/common/step/security/step_check_signature.h b/src/common/step/security/step_check_signature.h
index 1fd82a5..c4b45a6 100644 (file)
--- a/src/common/step/security/step_check_signature.h
+++ b/src/common/step/security/step_check_signature.h
@@ -42,7 +42,8 @@ class StepCheckSignature : public Step {
   Status precheck() override;
 
  private:
-  Status CheckSignatures(bool check_reference, PrivilegeLevel* level);
+  Status CheckSignatures(bool check_reference, bool is_preload,
+                         PrivilegeLevel* level);
   Status CheckSignatureMismatch();
   Status CheckPrivilegeLevel(PrivilegeLevel level);
 

diff --git a/src/unit_tests/signature_unittest.cc b/src/unit_tests/signature_unittest.cc
index 2d4f5a8..6594af2 100644 (file)
--- a/src/unit_tests/signature_unittest.cc
+++ b/src/unit_tests/signature_unittest.cc
@@ -27,7 +27,7 @@ TEST_F(SignatureValidatorTest, HandlesInitializedSignatureDir) {
   common_installer::CertificateInfo cert_info;
   std::string error;
   EXPECT_TRUE(ValidateSignatures(*signature_file, &level, &cert_info, true,
-                               &error));
+                                 false, &error));
 }
 
 // Tests signature verifier with signature directory containing bad signatures
@@ -38,7 +38,7 @@ TEST_F(SignatureValidatorTest, HandlesBadSignatureDir) {
   common_installer::CertificateInfo cert_info;
   std::string error;
   EXPECT_FALSE(ValidateSignatures(*signature_file, &level, &cert_info, true,
-                               &error));
+                                  false, &error));
 }
 
 }  // namespace security