light checksum for joomlaupdate by alikon · Pull Request #17632 · joomla/joomla-cms

alikon · 2017-08-20T10:16:05Z

...from #17619 (comment)
add light checksum for joomla update

Summary of Changes

trigger the checksum check on update
if the update server manifest have an hash tag

Testing Instructions

start with latest staging (for time of writing) version 3.8.0-beta5
apply pr checksum extensions light #17619
in order to simulate a joomlaupdate
- run php bump version 3.8.0-beta4 (i.e one version before)
set Update channel to custom URL for example (http://localhost/test/list_testpr17632.xml)
create that file with something like this content

<extensionset name="Joomla Core Test Updateserver" description="The Joomla Core Update Server for Tests of Alpha, Beta and RC Releases">
 <extension name="Joomla" element="joomla" type="file" version="3.8.0-beta4" targetplatformversion="3.8" detailsurl="http://localhost/test/extension_testpr17632.xml" />
</extensionset>

create http://localhost/test/extension_testpr17632.xml with something like this content

<?xml version="1.0" ?>
<updates>
	<update>
		<name>Joomla! 3.8</name>
		<description>Joomla! 3.8 CMS</description>
		<element>joomla</element>
		<type>file</type>
		<version>3.8.0-beta4</version>
		<infourl title="Joomla!">https://www.joomla.org</infourl>
		<downloads>
			<downloadurl type="full" format="zip">http://localhost/test/Joomla_pr17632-Update_Package.zip</downloadurl>
		</downloads>
		<tags>
			<tag>stable</tag>
		</tags>
		<maintainer>Joomla! PLT</maintainer>
		<maintainerurl>https://www.joomla.org</maintainerurl>
		<targetplatform name="joomla" version="3.[3456789]"/>
		<php_minimum>5.3.10</php_minimum>
	</update>
</updates>

download the last joomla update package for example https://github.com/joomla/joomla-cms/releases/download/3.8.0-beta4/Joomla_3.8.0-beta4-Beta-Update_Package.zip
copy & rename accordingly on the previous downloadurl tag (for example Joomla_pr17632-Update_Package.zip
Go to Components -> Joomla! Updates
you shoud see something like

Test case 1 - no checksum hashtag in the update server manifest

Expected result

a notice is showed

to test the next 2 cases we need to :

calculate the hash value (for example sha256)
-(on linux) run sha256sum Joomla_pr17632-Update_Package.zip

Test case 2 - correct checksum hashtag in the update server manifest

add a <sha256>correcthashvalue</sha256> tag in the current update server instance something like:

Expected result

a info is showed

Test case 3 - wrong checksum hashtag in the update server manifest

add a <sha256>wronghashvalue</sha256> tag in the current update server instance

Expected result

a warning is showed

Documentation Changes Required

new tags :

<sha256></sha256>
<sha384></sha384>
<sha512></sha512>

add light checksum to joomlaupdate

model

lang string

zero-24 · 2017-08-20T12:39:34Z

@mbabker can we have your final words on the algos as SHA1 and MD5 are very well known to be weak. Expecial as the core should provide a more secure algo.

mbabker · 2017-08-20T15:26:03Z

Personally I'd rather not support SHA1 and MD5 since they are weak. If SHA256 doesn't have the same weaknesses then that'd be fine.

alikon · 2017-08-21T06:22:51Z

ok now #17619 support only sha256

alikon · 2017-08-21T11:56:48Z

should we consider to add sha512 "longer is better" ?

zero-24 · 2017-08-21T16:24:29Z

should we consider to add sha512 "longer is better" ?

Sounds good. ;)

anibalsanchez · 2017-08-30T15:40:09Z

@alikon detailed the steps to create list.xml and extension_sts.xml.... so I guess he was thinking to enter the Url on the "Custom URL" field.

In "Joomla Update", you have "Options", where you can play with "Update Channel"
For testing, you can change it to a "Custom URL".

alikon · 2017-09-02T07:46:20Z

@anibalsanchez , @NunoLopes96
added more clear test info ;)

ghost · 2017-11-01T09:46:39Z

@anibalsanchez , @NunoLopes96 are Test Info @alikon suggested unclear?

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/17632.}

anibalsanchez · 2017-11-01T11:10:11Z

It is OK for me.

ghost · 2017-11-01T11:13:37Z

@anibalsanchez can i alter above Comment as successfully Test?

anibalsanchez · 2017-11-03T20:56:43Z

I have tested this item ✅ successfully on f61f6ab

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/17632.}

anibalsanchez · 2017-11-03T20:57:48Z

Test OK

My notes:

Apply PR checksum extensions light #17619 AND PR light checksum for joomlaupdate #17632
I tested updating from 3.8.0 to 3.8.1
After every test, Joomla is updated... so the patches have to be re-applied for the next test

These are my xmls:

list_testpr17632.xml

<extensionset name="Joomla Core Test Updateserver" description="The Joomla Core Update Server for Tests of Alpha, Beta and RC Releases">
 <extension name="Joomla" element="joomla" type="file" version="3.8.1" targetplatformversion="3.8" detailsurl="http://local-server.extly.com/j38/extension_testpr17632.xml" />
</extensionset>

extension_testpr17632.xml

<?xml version="1.0" ?>
<updates>
	<update>
		<name>Joomla! 3.8</name>
		<description>Joomla! 3.8 CMS</description>
		<element>joomla</element>
		<type>file</type>
		<version>3.8.1</version>
		<infourl title="Joomla!">https://www.joomla.org</infourl>
		<downloads>
			<downloadurl type="full" format="zip">http://local-server.extly.com/j38/Joomla_pr17632-Update_Package.zip</downloadurl>
		</downloads>
		<tags>
			<tag>stable</tag>
		</tags>
		<sha256>e8339bed3cbba5eebb7d355e026d29594ec164420beebe97839b0019b630ed96</sha256>
		<maintainer>Joomla! PLT</maintainer>
		<maintainerurl>https://www.joomla.org</maintainerurl>
		<targetplatform name="joomla" version="3.[3456789]"/>
		<php_minimum>5.3.10</php_minimum>
	</update>
</updates>

NunoLopesPT · 2017-11-10T17:32:09Z

I have tested this item ✅ successfully on f61f6ab

Great Work !!

_{This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/17632.}

alikon · 2017-11-10T17:46:01Z

@NunoLopes96 just a follow up from your work at Joomla GSoC 17 project https://github.com/joomla-projects/gsoc17_expand_extension_manager

ghost · 2017-11-11T05:56:44Z

RTC after two successful tests.

Quy · 2018-02-15T16:14:57Z

@brianteeman Please retag for v3.9.0. Darn bot!

alikon · 2018-03-12T19:04:35Z

conflict solved

alikon added 3 commits August 20, 2017 11:40

[3.8] - checksum joomlaupdate light

905cba2

add light checksum to joomlaupdate

model

1d22ddf

model

lang

f61f6ab

lang string

joomla-cms-bot added Language Change This is for Translators PR-staging labels Aug 20, 2017

zero-24 added the Documentation Required label Aug 20, 2017

anibalsanchez mentioned this pull request Nov 7, 2017

checksum extensions light #17619

Merged

joomla-cms-bot removed Documentation Required Language Change This is for Translators PR-staging labels Nov 11, 2017

joomla-cms-bot added the RTC This Pull Request is Ready To Commit label Nov 11, 2017

joomla-cms-bot changed the title ~~[3.8] - light checksum for joomlaupdate~~ light checksum for joomlaupdate Dec 22, 2017

joomla-cms-bot removed the RTC This Pull Request is Ready To Commit label Dec 22, 2017

joomla-cms-bot removed this from the Joomla 3.9.0 milestone Dec 22, 2017

joomla-cms-bot added the Language Change This is for Translators label Dec 22, 2017

joomla-cms-bot added PR-staging RTC This Pull Request is Ready To Commit labels Dec 22, 2017

brianteeman added this to the Joomla 3.9.0 milestone Feb 15, 2018

alikon mentioned this pull request Feb 27, 2018

[RFC] - Signed Package Validation #19792

Closed

Thomas Hunziker and others added 3 commits March 9, 2018 22:34

Update spanish installation language (#19878)

d3856de

implement check provided by @ggppdk (#19791)

b4ff7d8

Merge branch 'staging' into patch-92

da74b89

Merge branch '3.9-dev' into patch-92

1fbc762

joomla-cms-bot added PR-3.9-dev and removed RTC This Pull Request is Ready To Commit labels Mar 17, 2018

alikon deleted the patch-92 branch March 18, 2018 07:34

zero-24 added a commit to zero-24/joomla that referenced this pull request Apr 7, 2018

implement: joomla/joomla-cms#17632

be31b57

zero-24 mentioned this pull request Apr 7, 2018

[3.9] Next PR's against 3.9-dev joomlagerman/joomla#331

Merged

zero-24 mentioned this pull request Jun 3, 2018

[3.9] light checksum for joomlaupdate & Make sure the update hash checker produces the correct result joomlagerman/joomla#433

Closed

Uh oh!

Conversation

alikon commented Aug 20, 2017 • edited by joomla-cms-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of Changes

Testing Instructions

Test case 1 - no checksum hashtag in the update server manifest

Expected result

to test the next 2 cases we need to :

Test case 2 - correct checksum hashtag in the update server manifest

Expected result

Test case 3 - wrong checksum hashtag in the update server manifest

Expected result

Documentation Changes Required

Uh oh!

zero-24 commented Aug 20, 2017

Uh oh!

mbabker commented Aug 20, 2017

Uh oh!

alikon commented Aug 21, 2017

Uh oh!

alikon commented Aug 21, 2017

Uh oh!

zero-24 commented Aug 21, 2017

Uh oh!

anibalsanchez commented Aug 30, 2017

Uh oh!

alikon commented Sep 2, 2017

Uh oh!

ghost commented Nov 1, 2017

Uh oh!

anibalsanchez commented Nov 1, 2017

Uh oh!

ghost commented Nov 1, 2017

Uh oh!

anibalsanchez commented Nov 3, 2017

Uh oh!

anibalsanchez commented Nov 3, 2017

Uh oh!

NunoLopesPT commented Nov 10, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alikon commented Nov 10, 2017

Uh oh!

ghost commented Nov 11, 2017

Uh oh!

Quy commented Feb 15, 2018

Uh oh!

alikon commented Mar 12, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

alikon commented Aug 20, 2017 •

edited by joomla-cms-bot

Loading

NunoLopesPT commented Nov 10, 2017 •

edited

Loading