Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

fix: docker/winget VerifyHash fail closed — no silent skip when a hash is registered

Browse source 
Both previously logged hash_verification_skipped and returned nil when the
server had registered an expected hash the installer cannot verify. Now:
empty expected hash errors (consistent with dnf/apt), and a registered hash
without an implemented verifier blocks the install instead of pretending.
No behavior change today — the server only registers hashes for npm/pypi,
and handlers skip VerifyHash on empty hash — this closes the latent path.
This commit is contained in:
Fimeg 2026-06-11 04:20:20 -04:00
commit d223c4608a
2 changed files with 9 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

11
agent/internal/installer/docker.go
View file

@ -2,7 +2,6 @@ package installer
import (
"fmt"
"log"
"os/exec"
"strings"
"time"
@ -197,12 +196,10 @@ func (i *DockerInstaller) GetPackageType() string {
// VerifyHash verifies the Docker image hash before pulling
func (i *DockerInstaller) VerifyHash(imageName, version, expectedSHA256 string) error {
if expectedSHA256 == "" {
return nil // No hash to verify
return fmt.Errorf("no expected hash registered for image %q — hash verification is mandatory for capability-gated installs", imageName)
}
// Docker images use the registry's built-in signature verification
// (Docker Content Trust) rather than SHA256 file hashes
// Fail open - Docker has its own security model
log.Printf("[INFO] [agent] [installer] hash_verification_skipped package=%s reason=docker_uses_content_trust", imageName)
return nil
// TODO: Docker images should use registry digest verification (Docker Content Trust).
// Until implemented, fail closed — returning an error blocks the install.
return fmt.Errorf("hash verification not implemented for docker image %q — expected=%s", imageName, expectedSHA256)
}

13
agent/internal/installer/winget.go
View file

@ -3,7 +3,6 @@ package installer
import (
"encoding/json"
"fmt"
"log"
"os/exec"
"runtime"
"strings"
@ -380,15 +379,13 @@ func (i *WingetInstaller) UpdatePackage(packageName string) (*InstallResult, err
return i.Install(packageName)
}
// VerifyHash verifies the winget package hash before installation (fail-open)
// VerifyHash verifies the winget package hash before installation
func (i *WingetInstaller) VerifyHash(packageName, version, expectedSHA256 string) error {
if expectedSHA256 == "" {
return nil // No hash to verify
return fmt.Errorf("no expected hash registered for package %q — hash verification is mandatory for capability-gated installs", packageName)
}
// Winget packages are downloaded from Microsoft Store
// Hash verification would require accessing the store API
// For now, fail open - winget has its own package signing via Microsoft Store
log.Printf("[INFO] [agent] [installer] hash_verification_skipped package=%s reason=winget_uses_store_signing", packageName)
return nil
// TODO: Winget packages should use Microsoft Store API for hash verification.
// Until implemented, fail closed — returning an error blocks the install.
return fmt.Errorf("hash verification not implemented for winget package %q — expected=%s", packageName, expectedSHA256)
}