JAR signature verification #1

New issue

Closed

opened 2024-09-22 13:13:04 +02:00 by Minecon724 · 1 comment

Minecon724 commented

2024-09-22 13:13:04 +02:00

Owner

The signature should probably be hardcoded (but that would of course be abstract so up to implementation)
I think the JAR is first downloaded to a temp directory, so it should be verified there before moving to destination
- or verify it in place and ask to keep

- The signature should probably be hardcoded (but that would of course be abstract so up to implementation) - I think the JAR is first downloaded to a temp directory, so it should be verified there before moving to destination - or verify it in place and ask to keep

Minecon724 commented

2024-10-27 11:09:08 +01:00

Author

Owner

A way of changing signatures is also needed. We could sign a JAR with the old signature and add another one for future updates, but what about the future updates? We can't bundle every signature ever used.

I would say make another file with public keys and max supported versions