Add binary signature verification #558
Merged
+957
−217
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
753e955 to
3e18934
Compare
The main thing here is to pass in an Axios client instead of the SDK client since this does not need to make API calls and we will need to pass a separate client without headers when downloading external signatures. Otherwise the structure remains the same. Some variables are renamed due to being in a new context and some strings messages are simplified.
A tiny refactor since I will need to get a third config option.
33b14b9 to
18c3c88
Compare
18c3c88 to
860b1aa
Compare
They are not needed, and the packaging step will error that it looks like you are trying to package secrets due to the test key fixtures.
aslilac
approved these changes
Jul 25, 2025
|
cc @jdomeracki-coder in case you want to take a look, should be similar to the JetBrains plugin but I went with the original flow instead of the checkbox during login since we can have prompts with multiple buttons here. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I extracted the download function (since I needed to reuse it to download signatures) to a separate commit so it is easier to review the signature additions separately, if that is of interest.
This downloads the detached signature from Coder if available or releases.coder.com if not, then verifies the binary using that detached signature and the bundled public key. The check is performed only when the binary is first download.