Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Require switch on unofficial build #36

Closed
ferventcoder opened this issue Jan 20, 2015 · 3 comments
Closed

Require switch on unofficial build #36

ferventcoder opened this issue Jan 20, 2015 · 3 comments
Assignees
@ferventcoder
Labels
5 - Released Improvement Security
Milestone
0.9.9

Comments

@ferventcoder
Copy link
Member

The default one in the repository is for building source. If built in release mode, require a special switch to run --allow-unofficial-build or something like that.

When choco.exe detects that it is not using the official
publickeytoken, throw an error requiring an explicit override (this is
already overridden in debug builds). When AllowUnofficialBuild (--allow-unofficial-build) flag is
set to true, log a very important warning so that folks can receive
clues that the state of their system may be compromised.
@ferventcoder ferventcoder self-assigned this Jan 20, 2015
@ferventcoder ferventcoder added this to the 0.9.9 milestone Jan 20, 2015
ferventcoder added a commit that referenced this issue Jan 25, 2015
@ferventcoder
(GH-36) Allow unofficial build configuration
749058e
ferventcoder added a commit that referenced this issue Jan 25, 2015
@ferventcoder
(GH-36) Return PublicKeyToken as string
ce3a0a4
ferventcoder added a commit that referenced this issue Jan 25, 2015
@ferventcoder
(GH-36) Add official publickeytoken
59ba8f6 
Add official publickeytoken to application parameters. Adjust .uppercut
to search for an environment variable containing the official key
location
ferventcoder added a commit that referenced this issue Jan 25, 2015
@ferventcoder
(GH-36) check for official public key
a3158ec 
When choco.exe detects that it is not using the official
publickeytoken, throw an error requiring an explicit override (this is
already overridden in debug builds). When AllowUnofficialBuild flag is
set to true, log a very important warning so that folks can receive
clues that the state of their system may be compromised.
@gep13
Copy link
Member

gep13 commented Jan 25, 2015

Very cool! 👍

@ferventcoder ferventcoder changed the title Check for proper public key Require switch on unofficial build Jan 30, 2015
@smurawski
Copy link

👍 👍 Yay for security and yay for being able to build without the "official" key for testing purposes (without having to do a bunch of modifications that make pull requests suck).

@ferventcoder
Copy link
Member Author

most of that brought to you by this - 59ba8f6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ferventcoder ferventcoder

Labels
5 - Released Improvement Security
Projects
None yet
Milestone
0.9.9
Development

No branches or pull requests
3 participants
@ferventcoder @gep13 @smurawski