5b19f3b554
Completes the marketplace security model. Verification stops being advisory: a plugin only loads or migrates when its tree matches a trusted signature, and plugins are pulled from a signed shelf with anti-rollback and revocation. Enforcement (default OFF - existing deploys unchanged): - verification.py PluginVerifier, shared by the loader (verify-at-load, before plugin.py is imported) and the migration manager (verify-at-migrate, before any DDL). Fail-closed: an unsigned/tampered/wrong-key plugin does not run. - Gated by PLUGIN_REQUIRE_SIGNED. PLUGIN_DEV_TRUST_DIRS exempts named dirs but only under DEBUG/TESTING; production ignores it. - flask plugin stamp-bundled writes provenance into in-tree plugins so verify-at-load applies to bundled plugins too (image build step). - tier:core manifest guard: uninstall/disable refuse a core-tier plugin. Shelf (shelf.py): - Signed shelf-index.json (+ .sig): monotonic serial (a site refuses an older index - anti-rollback), revoked list carried across builds, per-entry version/tier/core_version for browse. Index is a browse layer only; adopt reads security-bearing fields from the verified artifact. - flask plugin shelf-build / shelf-list / adopt / audit. adopt verifies index + artifact (signature + every file hash), unpacks to staging, re-verifies, then atomically moves into place and installs+enables the closure. Refuses a downgrade without --force-downgrade. Anti-rollback serial stored in instance/shelf-state.json. - config PLUGIN_SHELF_DIR; the app only reads the folder, never speaks a network. .env.example + docs/PLUGIN-SIGNING.md document the flow. 22 tests: verifier policy (off / no-keys / signed / tampered / wrong-key / dev-exempt), verify-at-load + verify-at-migrate integration, tier guard, index sign/verify + tamper/wrong-key, serial state, revocation, version resolution, verified atomic unpack + tamper refusal. Live-smoked keygen->pack->shelf-build ->list->adopt->audit + serial guard. 1050 pass, naming green.
65 lines
2.5 KiB
Python
65 lines
2.5 KiB
Python
"""Plugin signature enforcement policy (ADR-013 Phase 2).
|
|
|
|
One PluginVerifier is built per app from config and shared by the loader
|
|
(verify-at-load) and the migration manager (verify-at-migrate). A plugin only
|
|
loads or migrates when it verifies against a trusted key - so signing stops
|
|
being advisory and becomes enforced everywhere plugin code executes.
|
|
|
|
Default is OFF (PLUGIN_REQUIRE_SIGNED unset), so existing deploys are
|
|
unchanged. A site opts into hardening by stamping its plugins
|
|
(`flask plugin stamp-bundled`), pinning keys (PLUGIN_TRUSTED_KEYS), and setting
|
|
PLUGIN_REQUIRE_SIGNED. Fail-closed: an unverifiable plugin does NOT run.
|
|
"""
|
|
|
|
import logging
|
|
from pathlib import Path
|
|
|
|
from . import signing, packaging
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class PluginVerifier:
|
|
"""Decides whether a plugin may load/migrate under the site's trust policy."""
|
|
|
|
def __init__(self, plugins_dir, require_signed=False, trusted_key_paths=None,
|
|
dev_trust_dirs=None, is_dev=False):
|
|
self.plugins_dir = Path(plugins_dir)
|
|
self.require_signed = bool(require_signed)
|
|
self.is_dev = bool(is_dev)
|
|
# dev trust dirs only mean anything in dev/test (ADR-013); prod ignores.
|
|
self.dev_trust_dirs = [Path(p).resolve() for p in (dev_trust_dirs or [])]
|
|
self._keys = signing.load_trusted_keys(trusted_key_paths or [])
|
|
|
|
def _dev_exempt(self, plugin_dir: Path) -> bool:
|
|
# unsigned dev/external-repo plugins pass, but ONLY under DEBUG/TESTING
|
|
if not self.is_dev or not self.dev_trust_dirs:
|
|
return False
|
|
resolved = Path(plugin_dir).resolve()
|
|
for trusted in self.dev_trust_dirs:
|
|
try:
|
|
resolved.relative_to(trusted)
|
|
return True
|
|
except ValueError:
|
|
continue
|
|
return False
|
|
|
|
def check(self, plugin_name: str):
|
|
"""(ok, reason). ok True = plugin may load/migrate."""
|
|
if not self.require_signed:
|
|
return True, 'enforcement off'
|
|
|
|
plugin_dir = self.plugins_dir / plugin_name
|
|
if self._dev_exempt(plugin_dir):
|
|
return True, 'dev-trusted'
|
|
|
|
if not self._keys:
|
|
# require-signed with nothing to verify against = refuse everything.
|
|
return False, ('PLUGIN_REQUIRE_SIGNED is set but no trusted keys '
|
|
'are configured')
|
|
|
|
_, errors = packaging.verify_dir(plugin_dir, self._keys)
|
|
if errors:
|
|
return False, '; '.join(errors)
|
|
return True, 'verified'
|